{"id":"CVE-2026-88234","published":"2026-11-10T19:21:32.247","lastModified":"2026-11-11T05:19:54.160","description":"Release of invalid pointer or reference in Windows iSCSI allows an unauthorized attacker to execute code over a network.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-763"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88234","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A release of an invalid pointer or reference (CWE-763) exists in the Windows iSCSI subsystem, allowing an unauthenticated remote attacker to trigger memory corruption that can lead to arbitrary code execution over the network.","exploitability":"Exploitation is highly likely due to the CVSS score of 9.8 and lack of authentication, privilege, or user interaction requirements; however, no public exploit code is currently available.","blast_radius":"Successful exploitation would allow full system compromise (confidentiality, integrity, availability) of any Windows host running the vulnerable iSCSI service, potentially enabling lateral movement across enterprise networks.","remediation":"Apply Microsoft security update MS26-XXXX (to be confirmed via Microsoft Security Response Center advisory at time of release); until then, disable the iSCSI Initiator service on non-essential systems and restrict iSCSI network access to trusted subnets only. No fixed version is published in the CVE description.","detection":"No reliable host or network indicator is derivable from the published description.","tags":[],"model":"garnet-coder","analyzedAt":"2026-11-11T09:51:36.019Z"}}