Windows IKE EUVD-2026-99381

Exploitation requires the target Windows host to have the IKE/IPsec service active and reachable, processing IKE key-exchange traffic on UDP ports 500/4500 (typical of IPsec VPN endpoints, IKEv2 remote-access servers, or domain IPsec policy hosts). The attacker needs network reachability to that IKE listener but no authentication (PR:N) and no user interaction (UI:N). The key limiting factor is deployment posture: hosts that do not expose an IKE/IPsec listener to the attacker's network segment are not reachable for this flaw, so internet-facing or untrusted-network-facing VPN gateways are the realistic exposure, and the impact is confined to service availability (DoS), not compromise of data or code execution.

This is a genuine but bounded availability risk, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, and the 7.5 score derives entirely from A:H with C:N/I:N - meaning the only outcome is denial of service, never data exposure or code execution. The signals are internally consistent and lean toward lower urgency: CISA's SSVC framework reports Exploitation 'none' (no observed activity), Technical Impact only 'partial,' and while Automatable is 'yes' (an attacker could script packet delivery at scale), there is no KEV listing and no POC indicator in the input, so exploitation status is 'no public exploit identified at time of analysis.' One cross-source tension to flag explicitly: the input Tags include 'Information Disclosure,' yet the CVSS vector sets C:N and the description states only denial of service - the tag contradicts the authoritative confidentiality metric and should be disregarded for triage. Net: prioritize patching on internet-facing IKE/IPsec endpoints because the DoS is network-reachable and automatable, but this is a service-crash issue, not a confidentiality or RCE event.

A remote, unauthenticated attacker sends a specially crafted IKE packet to a Windows host with IPsec/IKE listening on UDP 500/4500, triggering an out-of-bounds read in the IKE protocol handler and crashing the service. No public exploit code was identified in the provided data, but CISA SSVC rates the attack as automatable, so repeated delivery could sustain an outage. Because CVSS shows A:H with C:N/I:N, the realistic outcome is service disruption to VPN/IPsec connectivity, not data theft.