{"id":"CVE-2026-88234","aliases":[],"cve":{"records":[{"id":"CVE-2026-88234","source":"microsoft","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-09T22:05:19.671Z","published":"2026-11-10T18:16:56.383Z","modified":"2026-11-13T18:05:47.272Z"}],"publishers":[{"name":"microsoft","role":"CNA","organizationId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","modified":"2026-11-13T18:05:47.272Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-11T04:55:44.610Z"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88234","tags":["vendor-advisory","patch"],"source":"microsoft"}],"weaknesses":[{"id":"CWE-763","description":"CWE-763: Release of Invalid Pointer or Reference","source":"microsoft"}],"applicability":[{"source":"microsoft","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.14393.0","versionEndExcluding":"10.0.14393.9688"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.14393.0","versionEndExcluding":"10.0.14393.9688"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.17763.0","versionEndExcluding":"10.0.17763.9487"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.17763.0","versionEndExcluding":"10.0.17763.9487"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.20348.0","versionEndExcluding":"10.0.20348.5870"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.26100.0","versionEndExcluding":"10.0.26100.33822"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.26100.0","versionEndExcluding":"10.0.26100.33822"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T00:00:00+00:00","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"Windows iSCSI Remote Code Execution Vulnerability","titleSource":"microsoft","descriptionSource":"microsoft","description":"Release of invalid pointer or reference in Windows iSCSI allows an unauthorized attacker to execute code over a network.","score":9.8,"severity":"critical","published":"2026-11-10T18:16:56.383Z","modified":"2026-11-13T18:05:47.272Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Microsoft","name":"Windows Server 2016","platforms":["x64-based Systems"],"versions":[{"version":"10.0.14393.0","status":"affected","lessThan":"10.0.14393.9688","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-88234"},{"vendor":"Microsoft","name":"Windows Server 2016 (Server Core installation)","platforms":["x64-based Systems"],"versions":[{"version":"10.0.14393.0","status":"affected","lessThan":"10.0.14393.9688","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-88234"},{"vendor":"Microsoft","name":"Windows Server 2019","platforms":["x64-based Systems"],"versions":[{"version":"10.0.17763.0","status":"affected","lessThan":"10.0.17763.9487","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-88234"},{"vendor":"Microsoft","name":"Windows Server 2019 (Server Core installation)","platforms":["x64-based Systems"],"versions":[{"version":"10.0.17763.0","status":"affected","lessThan":"10.0.17763.9487","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-88234"},{"vendor":"Microsoft","name":"Windows Server 2022","platforms":["x64-based Systems"],"versions":[{"version":"10.0.20348.0","status":"affected","lessThan":"10.0.20348.5870","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-88234"},{"vendor":"Microsoft","name":"Windows Server 2025","platforms":["x64-based Systems"],"versions":[{"version":"10.0.26100.0","status":"affected","lessThan":"10.0.26100.33822","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-88234"},{"vendor":"Microsoft","name":"Windows Server 2025 (Server Core installation)","platforms":["x64-based Systems"],"versions":[{"version":"10.0.26100.0","status":"affected","lessThan":"10.0.26100.33822","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-88234"}],"remediation":[],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88234"],"sources":[{"name":"CVE","id":"CVE-2026-88234","modified":"2026-11-13T18:05:47.272Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-88234"}],"assessments":[{"source":"microsoft","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","score":9.8}],"sourceAffected":[],"observedAt":"2026-11-13T18:38:27.666Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:10:34.932Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-11T05:55:31.057Z","attemptedAt":"2026-11-11T05:55:31.057Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-11T05:55:31.323Z","attemptedAt":"2026-11-11T05:55:31.323Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-11T05:55:31.027Z","attemptedAt":"2026-11-11T05:55:31.027Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-11T05:55:30.833Z","attemptedAt":"2026-11-11T05:55:30.833Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-121536","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-121536","modified":"Nov 10, 2026, 11:48:27 PM","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","checkedAt":"2026-11-11T05:55:31.027Z"},{"source":"NVD","id":"CVE-2026-88234","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88234","modified":"2026-11-11T05:19:54.160","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-11T05:55:31.057Z"},{"source":"GitHub Advisory Database","id":"GHSA-8953-23pr-74q2","url":"https://github.com/advisories/GHSA-8953-23pr-74q2","modified":"2026-11-10T21:34:07Z","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-11T05:55:31.323Z"}],"aiSummary":{"text":"A weakness in Windows iSCSI, specifically a release of invalid pointer or reference, affects Windows Server 2016, 2019, 2022, and 2025. The affected versions are prior to 10.0.14393.9688, 10.0.17763.9487, 10.0.20348.5870, and 10.0.26100.33822 respectively. An attacker may exploit this weakness over a network.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-11T04:21:06.042Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-88234"}]}}