Windows IKE Extension EUVD-2026-73024

The IKE Extension service must be active and reachable - this is the case on any Windows system configured as a VPN server, DirectAccess endpoint, or IPsec gateway with UDP port 500 and/or 4500 accessible from the attacker. No authentication is required since IKE operates pre-authentication. Exploitation is limited to systems running the affected build numbers listed above; fully patched systems are not affected. Systems where IKE traffic is blocked by perimeter or host firewall rules, or systems that do not use IPsec/VPN at all, are not exploitable even if the vulnerable build is installed and the service is present.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects that IKE is a pre-authentication protocol reachable over the network, so no credentials are needed to trigger the crash. Attack complexity is low - a single malformed UDP packet targeting port 500 or 4500 is sufficient. No EPSS data was provided; no public exploit code or proof-of-concept has been identified; the vulnerability is not listed in the CISA KEV catalog. This indicates no confirmed active exploitation at time of analysis. Real-world priority depends heavily on network exposure: systems with IKE/IPsec firewall rules blocking inbound UDP 500/4500 from untrusted networks face negligible risk despite the network-vector rating. Internet-facing VPN gateways and RAS servers running the affected Windows builds represent the highest-risk population and should be patched promptly. The availability-only impact (C:N/I:N) limits the blast radius compared to RCE-class vulnerabilities.

An external attacker sends a specially crafted IKEv2 packet to UDP port 500 of a Windows Server 2025 system acting as a VPN gateway. The malformed message triggers the null pointer dereference in the IKE Extension service, causing it to crash and preventing all subsequent IPsec SA negotiations until the service is restarted or the system is rebooted. No prior authentication or credentials are required. No public proof-of-concept has been identified at time of analysis.