Loading vulnerability…
Windows iSCSI Remote Code Execution
CVE-2026-88234 is a release-of-invalid-pointer-or-reference vulnerability in Windows iSCSI that allows an unauthenticated attacker to execute arbitrary code over a network. An in-network attacker can exploit the vulnerability by calling endpoints without user interaction. The specific vulnerable function and affected Windows versions are not identified. Microsoft assigns a CVSS v3.1 base score of 9.8 and an Important severity rating, and assesses exploitation as less likely.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits remote arbitrary code execution with high impacts on confidentiality, integrity, and availability, potentially enabling data disclosure, unauthorized modification, and service disruption. The execution privilege level is not specified. No exploitation was reported at initial publication.
If you can’t patch tonight, do this now.
No vulnerability-specific interim mitigation or workaround is currently specified.
Patch, then assume compromise.
Apply the applicable Microsoft security update for CVE-2026-88234. An official fix is available; consult the Microsoft Security Response Center Security Update Guide to identify the update appropriate for the installed Windows release and architecture. Specific KB identifiers and fixed builds are not available in the supplied information.
No public exploits tracked yet. Mallory keeps watching.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.