EUVD-2026-72972
GHSA-4f9x-4hw5-fjhp
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable IKE service, but AC:H for heap-layout precondition and PR:L for required IKE peer authorization; full C/I/A:H reflects SYSTEM-level code execution.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Windows IKE Extension allows an authorized attacker to execute code over a network.
AnalysisAI
Heap-based buffer overflow in the Windows IKE (Internet Key Exchange) Extension allows an authorized network-adjacent attacker to achieve remote code execution across a wide range of Windows client and server releases. The vulnerability (CWE-122) resides in the IKE/IPsec negotiation subsystem and requires low-privilege access to trigger, placing the full C:H/I:H/A:H impact triad within reach of authenticated network peers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target system has the IKE and AuthIP IPsec Keying Modules service (ikeext) running and reachable over UDP 500 or 4500 - conditions met on any Windows host with IPsec or IKEv2 VPN configured. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.5 and reflects the key constraints: High Attack Complexity (IKE state-machine conditions must be satisfied, likely requiring a valid IKE handshake state or timing window) and Low Privilege (the attacker must be 'authorized', consistent with an established IPsec peer or VPN account). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft cumulative updates that bring affected builds to or above the fixed build numbers listed in EUVD-2026-72972: Windows Server 2025 to 10.0.26100.33438, Windows Server 2022 to 10.0.20348.5622, Windows Server 2019 to 10.0.17763.9245, Windows 11 24H2/25H2 to 10.0.26100.9445/10.0.26200.9445, Windows 11 23H2 to 10.0.22631.7582, Windows 11 26H1 to 10.0.28000.2954, and Windows 10 (21H2/22H2) to 10.0.19044.7725/10.0.19045.7725. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Windows systems with IKE/IPsec enabled, including VPN clients, servers, and branch-office infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today