CVE-2026-73025

Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network.

Scoring

Severity

CRITICAL

CVSS base score

9.8

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

EPSS probability

0.92%

CWE

CWE-1390

Published

2026-09-08

Last modified

2026-09-10

Affected products

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Microsoft Windows Server 2012
• Microsoft Windows Server 2012 (Server Core installation)
• Microsoft Windows Server 2012 R2
• Microsoft Windows Server 2012 R2 (Server Core installation)
• Microsoft Windows Server 2016
• Microsoft Windows Server 2016 (Server Core installation)

Weakness type

• CWE-1390

Related vulnerabilities

• CVE-2026-77483 — SQL Server Elevation of Privilege Vulnerability
• CVE-2026-62895 — Azure Arc SQL Server Extension Elevation of Privilege Vulnerability
• CVE-2026-80219 — Hawtio-operator: hawtio-operator: oauthclient created with grantmethod auto and no secret enables oauth token theft
• CVE-2026-73819 — Ebyte NA111-M Weak Authentication
• CVE-2026-44476 — Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret
• CVE-2026-65098 — NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an...
• CVE-2026-68067 — Mira Hormone Monitor, Mira Android App Weak Authentication
• CVE-2026-59135 — Microsoft Windows Search Component Information Disclosure Vulnerability

Markdown version · Browse all CVEs