External risk intelligence

Windows iSCSI Weak Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-73025

Windows iSCSI is a storage networking protocol typically deployed within internal, isolated, or private networks to connect servers to storage arrays. While it operates over a network, it is rarely exposed directly to the public internet in standard deployment patterns.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Windows iSCSI, a network storage technology. This weakness allows unauthorized attackers to bypass security features remotely, potentially leading to significant compromise if exploited. The primary concern at this time is to confirm if our environment utilizes this specific technology and assess any potential exposure.

Weak authentication allows remote bypass.
Critical network storage vulnerability.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

Attackers can remotely access Windows iSCSI, bypassing its authentication to gain unauthorized access to sensitive storage resources. This vulnerability allows an attacker to exploit a weak authentication mechanism to compromise the confidentiality, integrity, and availability of data.

Network access required.
Bypass iSCSI authentication.
Unauthorized access to storage.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in Windows iSCSI could allow an unauthenticated attacker to bypass security controls when accessing storage over a network, potentially leading to unauthorized access and modification of data. This could affect system data and service behavior when the iSCSI feature is exposed externally.

System data may be accessed.
Network exposure could lead to bypass.
Unauthorized access to data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The critical weakness in Windows iSCSI's authentication mechanism presents a significant risk over networks, enabling unauthorized access with high impact. Responsibility for addressing this vulnerability likely falls to infrastructure or platform teams managing storage systems, in coordination with network and security teams. The immediate first step is to locate all instances of Windows iSCSI, determine their network exposure and criticality, identify the asset owners, and then prioritize remediation efforts based on the assessed risk.

Infrastructure or platform teams own remediation.
Verify iSCSI network exposure and criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Windows iSCSI and why is it used?

Windows iSCSI is a storage networking standard that allows servers to connect to remote storage arrays over IP networks. It treats remote storage as if it were locally attached, enabling centralized data management and backup. Organizations typically use it in data centers to facilitate shared storage resources for applications that require high performance and accessibility across their internal infrastructure.

What does the weak authentication weakness mean for CVE-2026-73025?

This vulnerability, classified as CWE-1390, involves a flaw in how the system verifies the identity of users or devices attempting to connect. Because the authentication mechanism is weak, an unauthorized party can circumvent security checks. In the context of this CVE, it means the protective barriers meant to block unapproved access to storage resources are ineffective, allowing someone to gain control without legitimate credentials.

How does an attacker trigger this vulnerability?

An attacker triggers this bug by sending specific network requests to a vulnerable Windows iSCSI implementation. Because the system fails to properly authenticate these requests, the attacker can bypass security controls remotely. Importantly, this does not require a local user to perform any action, nor does it rely on physical access; it is purely a network-based issue that occurs when the system incorrectly handles unauthorized connection attempts.

Do I need to worry if my Windows iSCSI instances are internal?

According to Halo Surface Signal, this vulnerability is categorized as unlikely to be exposed to the public internet because iSCSI is generally deployed within isolated or private network segments. If your systems are strictly internal and not reachable from the internet, the immediate risk is lower. You should still monitor these systems, but focus your initial attention on any instances that might be inadvertently reachable from broader or less secure networks.

What should I do first to address CVE-2026-73025?

Your first step is to inventory your environment to locate all systems running the Windows iSCSI feature. Once identified, map these assets to determine their network location and assess if any are exposed to untrusted segments. Work with your infrastructure and storage teams to verify their current configuration and ensure that access is restricted to authorized devices only while you await further guidance or updates from the vendor.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-73025

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.