EUVD-2026-29632
GHSA-g3x8-gm4j-w8q6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed IKE service (UDP 500/4500)
-
DeliverySend crafted IKE negotiation packets
-
ExploitTrigger unfreed memory allocation per exchange
-
ExecutionRepeat to accumulate leak
-
ImpactExhaust host memory, deny VPN service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
| Exploitation Conditions | The target must have the Windows IKE/IPsec keying service (IKEEXT) active and its IKE ports (UDP 500/4500) reachable by the attacker - this is the case on IPsec VPN servers/gateways and any host configured to negotiate IPsec. No special conditions beyond that: exploitation is remote and unauthenticated (PR:N/UI:N) with low complexity. Limiting factors: hosts that do not run IPsec/IKE or that firewall UDP 500/4500 to trusted peers are not exposed; impact is confined to availability (service degradation/DoS) with no confidentiality or integrity effect, and a DoS typically requires sustained packet delivery rather than a single request. |
| Impact | Signals are consistent and point to a moderate, availability-only risk. CVSS 3.1 base is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - trivially reachable over the network but impacting only availability. CISA SSVC aligns: Exploitation 'none', Automatable 'yes' (a memory-leak DoS is easily scripted/repeated), Technical Impact 'partial' (degradation/DoS, not takeover). EPSS is low at 0.08% and it is not on CISA KEV, so widespread exploitation is not currently expected. The one inconsistency to flag: the input Tags include 'Authentication Bypass', which conflicts with the description (memory-leak DoS) and the CVSS impact metrics (C:N/I:N/A:H) - the tag appears to be a mislabel and should be disregarded in favor of the DoS classification; verify with the Microsoft advisory. Net: patch on a normal cycle, prioritizing internet-exposed IKE/IPsec VPN endpoints where the UDP 500/4500 attack surface is reachable. |
| Exploit ScenarioDerived | An attacker who can reach a Windows host's IKE service (UDP 500/4500) - typically an internet-facing IPsec VPN gateway - sends a sustained stream of crafted IKE negotiation packets, each of which causes a small unfreed allocation. Over time the leaked memory accumulates until the IKEEXT service or host degrades and denies service to legitimate VPN clients. No credentials or user interaction are required (AV:N/AC:L/PR:N/UI:N), and the low-complexity, automatable nature makes the attack easy to script, though no public exploit is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Denial of service in the Windows Internet Key Exchange (IKE) protocol implementation allows remote unauthenticated attackers to exhaust host memory across all supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through Server 2025). The flaw is a memory leak (CWE-401) triggered over the network with no privileges or user interaction, but impact is limited to availability with no data exposure. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.08%, 23rd percentile).
RemediationAI
Apply the Microsoft security update for CVE-2026-35424, upgrading each edition to at least the fixed build listed in the advisory (for example Windows 11 24H2 to 10.0.26100.8457, Server 2025 to 10.0.26100.32860, Server 2022 to 10.0.20348.5139, Windows 10 22H2 to 10.0.19045.7291); consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35424 for the exact build per SKU. Where patching must be deferred on exposed hosts, reduce the IKE attack surface by restricting UDP 500 and 4500 with host or perimeter firewall rules so that only trusted VPN peers can reach the IKEEXT service - this blocks the untrusted-source leak vector but will break IPsec/IKE negotiation from any peer that is filtered out, so scope rules to legitimate VPN endpoints only. On systems that do not use IPsec/IKE, disabling the IKE and AuthIP IPsec Keying Modules (IKEEXT) service removes the vulnerable surface entirely, at the cost of IPsec functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 36 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IKE is the key-negotiation protocol underpinning IPsec VPNs and IPsec-secured traffic on Windows, handled by the IKEEXT service (over UDP 500/4500). The root cause is CWE-401, Missing Release of Memory After Effective Lifetime: the IKE handler allocates memory for incoming negotiation packets but fails to free it under certain conditions, so each malicious or malformed exchange leaks memory that is never reclaimed. Sustained delivery of such packets gradually exhausts non-paged pool or process memory, degrading or crashing the service. The CPE set spans the Microsoft Windows OS line broadly, confirming this lives in the shared IKE/IPsec stack rather than a single edition-specific feature.
Know when Windows Server 2012 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated packets to the IKE service with low complexity (AV:N/AC:L/PR:N/UI:N); memory-leak DoS yields availability-only impact (A:H, C:N/I:N).
Primary rating from NVD.
CVSS VectorNVD
DescriptionCVE.org
Missing release of memory after effective lifetime in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.
Executive ViewAI
A network-accessible vulnerability in Windows IKE protocol can disrupt VPN and remote access connectivity across the organization, affecting Windows 10, Windows 11, and all supported Windows Server versions. With no public exploit identified at time of analysis and extremely low exploitation probability (0.1% EPSS), this represents a manageable risk requiring scheduled patching rather than emergency response.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Exploit-DB