EUVD-2026-73563
GHSA-mf7x-rcpw-8jpg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
IKE operates pre-authentication over the network (AV:N/PR:N); null dereference crashes service (A:H) with no confidentiality or integrity impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network.
AnalysisAI
Null pointer dereference in the Windows Internet Key Exchange (IKE) Extension enables remote unauthenticated attackers to crash the IKE service, causing denial of service on affected systems. The flaw spans twelve distinct Windows releases from Windows 10 21H2 through Windows 11 26H1 and Windows Server 2019 through Server 2025, and is reachable over the network with no credentials or user interaction required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication and no user interaction are required - a remote attacker needs only network reachability to UDP port 500 or 4500 on the target. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (score 7.5) accurately characterizes this flaw: network-reachable, trivially exploitable DoS with zero authentication or user interaction required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Microsoft's security update for the relevant Windows release via Windows Update, WSUS, or Microsoft Update Catalog. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and catalog all systems running Windows 10, 11, or Windows Server 2019-2025 that expose IKE endpoints over networks, particularly hybrid cloud and VPN infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today