CVE-2026-65791 is a remote-code-execution vulnerability in Windows iSCSI Target Server that can be reached over the network without authentication. It challenges a common assumption that storage networks are inherently trusted because ordinary users do not work on them. Initiators, hypervisors, backup systems, and clustered servers still exchange privileged storage traffic across a service that must be patched like any other reachable server component.
Why it matters in production
The inventory should map every target server to virtual disks, initiator IQNs, authentication, portals, VLANs, multipath configuration, clustering or failover role, and dependent workloads. It should also find test or migration targets that were left online. A listener restricted to a storage VLAN is less exposed than an internet service, but lateral access inside that network can carry a much larger availability impact.
Before maintenance, capture configuration and active sessions, confirm alternate paths, verify recent recovery points, and understand how initiators reconnect. Patch one node or path at a time where architecture permits. Afterward, validate persistent targets, MPIO state, disk visibility, reservation behavior, cluster resources, latency, event logs, and application I/O rather than stopping at a successful service start.
The change is also an opportunity to reduce trust. Limit portals and firewall rules to required initiators, separate management from data paths, remove obsolete targets, review CHAP where applicable, and monitor unexpected sessions. Storage isolation must be an enforced network and identity design, not an assumption based on who normally knows the VLAN number.
Practical takeaway
The practical conclusion is to combine security and storage operations for iSCSI Target maintenance. Patch the server, prove every dependent path, and narrow reach to the systems that require it. Storage availability and storage security share the same implementation; treating them as separate change processes leaves the most important failure paths untested.