Windows IKE CVE-2026-50696

Exploitation requires the target to have the Windows IKE/IPsec service (IKEEXT) running and its IKE listener reachable by the attacker over the network - typically UDP port 500 and/or UDP 4500 (NAT-T) exposed to untrusted networks, as on VPN/IPsec gateways. Given AV:N/AC:L/PR:N/UI:N, no authentication, credentials, or user interaction are needed against a reachable listener. The primary limiting factor is exposure and configuration: hosts that do not run IPsec/IKE, or that firewall UDP 500/4500 to trusted peers only, are not remotely exploitable; impact is confined to denial of service (A:H, C:N/I:N) with no data disclosure or code execution demonstrated.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes an easily reachable, unauthenticated, no-interaction network attack whose sole impact is availability - consistent with the description's 'deny service over a network.' The 7.5 score is driven entirely by A:H; there is no confidentiality or integrity exposure, so this is not an RCE despite being a heap overflow (memory corruption in this case manifests as a crash rather than confirmed code execution). No EPSS score, SSVC decision, POC, or KEV entry was provided, so real-world exploitation likelihood cannot be quantified from the input; absence of KEV/POC data means there is no public exploit identified at time of analysis and no evidence of active exploitation. Practical risk is gated by exposure: hosts with IKE/IPsec (UDP 500/4500) reachable from untrusted networks are genuinely at risk of remote crashes, whereas systems that do not run IPsec/IKE or have those ports firewalled have little exposure. Overall this is a legitimate but availability-only priority - high-value for internet-facing VPN gateways, lower for internal-only endpoints.

An attacker who can reach a Windows host's IKE listener (UDP 500/4500) - for example an internet-facing VPN gateway - sends a specially crafted IKE negotiation packet that overflows a heap buffer during key-exchange parsing, crashing the IKE service or the system and dropping all IPsec/VPN connectivity. No authentication or user interaction is required (PR:N/UI:N) and complexity is low (AC:L), so the attack can be repeated to sustain an outage; no public exploit is identified at time of analysis.