Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
MonitorCVSS 6.5CVE-2026-83685Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Buffer over-read vulnerability in Windows IKE Extension allows an authorized attacker on the network to send a specially crafted IKE protocol message, causing the IKE service to crash and deny service. This disrupts VPN and IPsec communications on affected systems. Exploitation is assessed as unlikely but affects all current and legacy Windows versions using IKE/IPsec.
What this means
What could happen
An authorized attacker on your network could send a malformed IKE (Internet Key Exchange) message to crash the Windows IKE service, disrupting VPN and IPsec connections until the service restarts or the system reboots.
Who's at risk
Windows systems and servers used for VPN and IPsec connectivity, particularly remote access infrastructure, branch office gateways, and any systems relying on Windows-native IKE for encrypted network communications. This includes Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025.
How it could be exploited
An attacker with network access to a Windows system must send a specially crafted IKE protocol message to the system's IKE Extension service. This triggers a buffer over-read in the IKE processing code, causing the service to fail and deny VPN/IPsec connectivity.
Prerequisites
- Network access to the target Windows system
- Valid user credentials or authenticated access to initiate IKE negotiation
- IKE/IPsec services enabled and accessible from the attacker's location
Remotely exploitableRequires authenticationLow complexity exploitationAffects availability of VPN/IPsec services
Exploitability
Some exploitation risk — EPSS score 1.1%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/1WORKAROUNDRestrict network access to IKE/IPsec ports (UDP 500, UDP 4500) to only authorized VPN clients and trusted networks using firewall rules
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXApply the October 2026 Windows security update to all affected systems (Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025)
Long-term hardening
0/1HARDENINGSegment network access so that only systems requiring VPN/IPsec connectivity have exposure to untrusted networks
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/283904d4-62fe-4bdb-9349-d38eeb97f91eGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.