Windows IKE Extension CVE-2026-69881

No authentication and no user interaction are required - a remote attacker needs only network reachability to UDP port 500 or 4500 on the target. The IKEEXT service runs by default on Windows and starts automatically on most configurations, meaning even hosts not explicitly configured as VPN servers may expose this surface. Systems protected by a perimeter firewall blocking inbound UDP 500/4500 from untrusted sources are not directly exploitable from those sources. The vulnerability is in the IKE negotiation handler itself, so it is reachable before any IPsec policy or peer certificate check is applied - no special IPsec configuration on the victim side is required.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (score 7.5) accurately characterizes this flaw: network-reachable, trivially exploitable DoS with zero authentication or user interaction required. Impact is strictly availability - confidentiality and integrity are unaffected, which caps the practical damage to VPN/IPsec service disruption. No EPSS score is available in the supplied data; the combination of low complexity and a widely deployed attack surface suggests moderate exploitation probability for adversaries targeting IPsec infrastructure. No KEV listing and no POC code are present in the input, so no confirmed active exploitation is known. Organizations running Windows IPsec VPN gateways exposed to untrusted networks should treat this as a high-priority patch target; workstations and internal servers not hosting IPsec endpoints face reduced real-world risk if perimeter firewalls block UDP 500/4500 inbound.

An attacker sends a single specially crafted IKEv2 initiation packet to UDP port 500 on an internet-exposed Windows Server running the IKEEXT service, triggering a null pointer dereference in the IKE Extension before any authentication exchange completes. The service crashes, terminating all active IPsec sessions and rendering the VPN gateway unavailable until manually restarted. No public proof-of-concept has been identified, but the IKEv1/IKEv2 specifications are publicly documented, lowering the barrier for independent exploit development.