# CVE-2026-83684: Windows iSCSI Target Service buffer over-read

Source: https://junglewise.ai/threats/cve-2026-83684-buffer-over-read-in-windows-iscsi-target-service-allows-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-83684 · Severity: high · CVSS 7.5 · Published 2026-11-10

Windows iSCSI Target Service, which handles storage networking protocols on Windows servers, contains a buffer over-read vulnerability that allows attackers to read sensitive information from system memory over the network. An attacker can exploit this flaw without authentication to obtain confidential data, potentially revealing credentials, configuration details, or other sensitive information stored in memory.

Technologies: [Microsoft Windows iSCSI Target Service](https://junglewise.ai/threats/technologies/windows-iscsi-target-service). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-83684 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-83684 being exploited in the wild.

**How severe is CVE-2026-83684?** High severity, with a CVSS score of 7.5, published 10 November 2026.

**Which products and versions are affected?** Microsoft Windows iSCSI Target Service.

**Is there a fix for CVE-2026-83684?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-83684 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-83684?** Check whether you run Microsoft Windows iSCSI Target Service. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A buffer over-read vulnerability in Windows iSCSI Target Service permits unauthorized disclosure of information via network access without requiring authentication. The flaw allows an attacker to read beyond intended buffer boundaries, exposing sensitive data from process memory. Exploitation requires only network connectivity to the target system running the vulnerable iSCSI service.

## Affected products

- Microsoft Windows iSCSI Target Service

## Timeline

- 2026-11-10: disclosed

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83684](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83684)

## Related threats

- [Microsoft Windows iSCSI Target Service uncaught exception denial of service](https://junglewise.ai/threats/cve-2026-69839-microsoft-windows-iscsi-target-service-uncaught-exception-denial)
- [Microsoft Windows iSCSI Target Service heap buffer overflow](https://junglewise.ai/threats/cve-2026-65791-microsoft-windows-iscsi-target-service-heap-buffer-overflow)
- [Microsoft Windows iSCSI Target Service null pointer dereference](https://junglewise.ai/threats/cve-2026-65681-microsoft-windows-iscsi-target-service-null-pointer-dereference)
- [Microsoft Windows iSCSI Target Service heap buffer overflow](https://junglewise.ai/threats/cve-2026-65679-microsoft-windows-iscsi-target-service-heap-buffer-overflow)