A weak authentication flaw in the Windows iSCSI component lets an unauthenticated remote attacker bypass a security feature across the network, carrying a CVSS 3.1 base score of 9.8 (Critical).
What Is It
Microsoft disclosed CVE-2026-73025 on September 8, 2026, describing it as weak authentication in Windows iSCSI that "allows an unauthorized attacker to bypass a security feature over a network." It is classified as CWE-1390 (Weak Authentication). The NVD record is currently in "Awaiting Analysis" status, so enrichment beyond Microsoft's own submission is still pending.
Why It Matters
The CVSS vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, is about as bad as the scoring system gets short of a scope change. The attack is reachable over the network, requires low complexity, needs no privileges, and needs no user interaction, while impacting confidentiality, integrity, and availability at High. That combination produces the maximum exploitability subscore of 3.9 alongside an impact subscore of 5.9.
iSCSI is a storage-network protocol, so the exposure sits on the path between hosts and block storage. Any environment where iSCSI traffic is reachable from an untrusted segment should treat this as a priority.
As of publication, CVE-2026-73025 does not appear in the CISA Known Exploited Vulnerabilities Catalog, so there is no public evidence of active exploitation and no KEV-mandated remediation deadline. Absence from the catalog is not proof that exploitation is not occurring, and the listing should be rechecked as the vulnerability ages.
What's Vulnerable
Microsoft lists a broad swath of supported and legacy Windows builds as affected, with fixes delivered at the following build numbers:
| Product | Fixed in |
|---|---|
| Windows 10 Version 1607 / Server 2016 (incl. Server Core) | 10.0.14393.9512 |
| Windows 10 Version 1809 / Server 2019 (incl. Server Core) | 10.0.17763.9245 |
| Windows Server 2012 (incl. Server Core) | 6.2.9200.26349 |
| Windows Server 2012 R2 (incl. Server Core) | 6.3.9600.23397 |
| Windows Server 2022 | 10.0.20348.5622 |
| Windows Server 2025 (incl. Server Core) | Confirm against the MSRC Update Guide |
The Windows Server 2025 entry is deliberately left unstated here. The revision number reported for the 26100 branch does not fit the pattern of the other rows; revision numbers accumulate over a servicing branch's lifetime, so the newest product in the list should carry a lower revision than the older branches, not a substantially higher one. Rather than propagate a build number that may be a transcription artifact, administrators should read the fixed build for Server 2025 directly off the MSRC Update Guide entry linked below. The same check is worth doing for the remaining rows before they are used as the basis for a compliance baseline.
Both 32-bit and x64 systems are affected for the Windows 10 client versions; the server products are listed for x64-based systems.
Patch Status
Microsoft has published guidance through the MSRC Update Guide. Fixed builds are listed above for every affected product except Windows Server 2025, whose fixed build should be read directly from the MSRC entry. Remediation is to update to at or above the fixed build number for each platform, verified against MSRC. No workaround or mitigation has been published.
Sources
- Microsoft Security Response Center, CVE-2026-73025 Update Guide
- NVD, CVE-2026-73025
- CISA, Known Exploited Vulnerabilities Catalog