OTPulse

Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability

Plan PatchCVSS 7.5CVE-2026-50696Jul 14, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Heap-based buffer overflow in the Windows Internet Key Exchange (IKE) Protocol allows an unauthenticated attacker to cause a denial of service over the network by sending specially crafted packets to systems with IKE enabled.

What this means
What could happen
An attacker could send malicious network packets to crash Windows servers running IKE (used for VPN and remote access), disrupting remote connectivity and potentially interrupting operations that depend on remote access or VPN tunnel availability.
Who's at risk
Any organization using Windows servers for VPN, remote access, or site-to-site connectivity should prioritize this, including municipal utilities with remote SCADA access, water authorities with VPN-dependent telemetry systems, and any facility relying on remote engineering workstation access over IKE tunnels.
How it could be exploited
An attacker sends specially crafted packets to port 500 (IKE) or 4500 (IKE with NAT-T) on a Windows system with IKE enabled. The packets trigger a heap buffer overflow that crashes the IKE service, making VPN and remote access connections unavailable.
Prerequisites
  • Network access to UDP port 500 (IKE) or port 4500 (IKE with NAT-T)
  • Target system has IKE enabled (typically on servers offering VPN or remote access)
  • No authentication required
Remotely exploitableNo authentication requiredLow complexityAffects availability (denial of service)Impacts remote access and VPN connectivity
Exploitability
Some exploitation risk — EPSS score 1.2%
Affected products (19)
19 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9020
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9020
Windows Server 2019All versionsBuild 10.0.17763.9020
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9020
Windows Server 2022All versionsBuild 10.0.20348.5386
Remediation & Mitigation
0/10
Do now
0/2
WORKAROUNDIf IKE is not required, disable IKE services on Windows systems
WORKAROUNDRestrict network access to UDP ports 500 and 4500 from untrusted networks using firewall rules
Schedule — requires maintenance window
0/8

Patching may require device reboot — plan for process interruption

Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9020 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5386 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33158 or later
All products
HOTFIXUpdate Windows 10 Version 1809 (32-bit) to Build 10.0.17763.9020 or later
HOTFIXUpdate Windows 10 Version 1809 (x64) to Build 10.0.17763.9020 or later
HOTFIXUpdate Windows 10 Version 21H2 to Build 10.0.19044.7548 or later
HOTFIXUpdate Windows 10 Version 22H2 to Build 10.0.19045.7548 or later
HOTFIXUpdate Windows 11 (all versions) to the latest security patch version for your release
View full vendor advisory
API: /api/v1/advisories/f38cbc7b-fdbf-4d6d-b1c9-902a92ec3997

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.