OTPulse

Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability

Plan PatchCVSS 7.5CVE-2026-69587Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A null pointer dereference in the Windows Internet Key Exchange (IKE) Extension allows an unauthenticated attacker to crash the IKE service via a malformed network packet. This denial of service vulnerability affects Windows Server 2022, Windows Server 2025, and all current versions of Windows 11 (23H2, 24H2, 25H2, and 26H1). The vulnerability is remotely exploitable without credentials and requires only network access to the IKE ports (500/UDP and 4500/UDP).

What this means
What could happen
An attacker can crash the Windows IKE (Internet Key Exchange) service over the network without credentials, temporarily disrupting VPN and encrypted communication capabilities on affected servers and workstations.
Who's at risk
Windows Server 2022 and 2025 administrators who operate VPN endpoints or remote access infrastructure, and Windows 11 users on networks where VPN or IKE-based encrypted communications are deployed. This primarily affects IT infrastructure used to secure remote connections to operational facilities.
How it could be exploited
An attacker sends a malformed IKE packet to port 500 (UDP) or 4500 (UDP) on a Windows system running IKE. The packet triggers a null pointer dereference in the IKE Extension, causing the service to crash and stop processing VPN connection requests.
Prerequisites
  • Network access to UDP port 500 or 4500 on the target Windows system
  • No credentials required
remotely exploitableno authentication requiredlow complexityaffects VPN and secure communications
Exploitability
Some exploitation risk — EPSS score 1.2%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Windows Server 2022All versionsBuild 10.0.20348.5622
Windows Server 2022 (Server Core installation)All versionsBuild 10.0.20348.5622
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33438
Windows 11 Version 25H2 for ARM64-based SystemsAll versionsBuild 10.0.26200.9445
Windows 11 Version 25H2 for x64-based SystemsAll versionsBuild 10.0.26200.9445
Windows 11 Version 23H2 for ARM64-based SystemsAll versionsBuild 10.0.22631.7582
Windows 11 Version 23H2 for x64-based SystemsAll versionsBuild 10.0.22631.7582
Windows 11 Version 24H2 for ARM64-based SystemsAll versionsBuild 10.0.26100.9445
Remediation & Mitigation
0/4
Do now
0/1
WORKAROUNDRestrict network access to UDP ports 500 and 4500 at the firewall to only trusted VPN clients and remote access servers
Schedule — requires maintenance window
0/3

Patching may require device reboot — plan for process interruption

Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5622 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33438 or later
All products
HOTFIXUpdate Windows 11 to the latest patched build (23H2: 10.0.22631.7582, 24H2: 10.0.26100.9445, 25H2: 10.0.26200.9445, or 26H1: 10.0.28000.2954)
View full vendor advisory
API: /api/v1/advisories/50206468-60d6-4c34-9035-2213898edc8c

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability | CVSS 7.5 - OTPulse