The vulnerability is an out‑of‑bounds read in Windows iSCSI that allows a local host user with sufficient privilege to read memory beyond the intended buffer boundaries, resulting in the disclosure of sensitive information. The flaw is classified as CWE‑125.

The flaw affects Microsoft Windows customers on a broad range of products. The CNAs list the following: Windows 10 from version 1607 through 22H2, Windows 11 from 23H2 through 26H2, several Windows 11 ARM versions, and multiple Windows Server releases including 2012, 2016, 2019, 2022 and the upcoming 2025. All editions listed in the advisory are vulnerable; no specific sub‑versions are excluded.

The assessed CVSS score is 5.5, indicating a moderate severity. The EPSS score is not available and the vulnerability is not in the CISA KEV catalog, suggesting that it is not commonly exploited. Because the flaw requires an authorized local user to trigger the out‑of‑bounds read, the attack vector is local, not remote. The best protection is to apply any vendor patch that addresses CVE‑2026‑69721 as soon as one is published, limit the use of the iSCSI Initiator service on machines that do not require it, and enforce least‑privilege for local accounts.