CVE-2026-73025: CWE-1390: Weak Authentication in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-73025) concerns weak authentication mechanisms in the Windows iSCSI service on Windows 10 Version 1607 and related builds. It enables an attacker with network access to bypass security controls without requiring privileges or user interaction. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability affects several Windows 10 versions including builds from 10.0.14393.0 up to but not including 10.0.14393.9512, 10.0.17763.0 up to 10.0.17763.9245, 6.2.9200.0 up to 6.2.9200.26349, 6.3.9600.0 up to 6.3.9600.23398, 10.0.20348.0 up to 10.0.20348.5622, and 10.0.26100.0 up to 10.0.26100.33438. Microsoft has published an official fix for this issue.

Successful exploitation allows an attacker to bypass authentication security features remotely over the network, leading to complete compromise of confidentiality, integrity, and availability of the affected system. This could enable unauthorized access and control over the system without requiring privileges or user interaction.

An official fix is available from Microsoft and should be applied promptly. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-73025 for patch details and update instructions.