Windows IKE Extension EUVD-2026-99912

Exploitation requires that IKE/IPsec be configured and actively negotiating on the target Windows host (the Windows IKE Extension must be in use), and the attacker must occupy a network position that lets them inject or manipulate IKE handshake traffic the host trusts in a security decision - consistent with the CVSS AC:H rating implying a man-in-the-middle vantage or a timing/race condition rather than a single unsolicited packet. No valid credentials are needed (PR:N, unauthenticated) and no user interaction is required (UI:N). The principal limiting factors are the HIGH attack complexity (privileged network placement or race-window dependency) and the requirement that IPsec/IKE actually be deployed and in active use on the target; hosts not using IKE/IPsec are not exposed.

Signals are moderately consistent but point to a serious-yet-conditional threat rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated flaw with no user interaction but HIGH attack complexity, and the 8.1 base score is driven by total impact (C:H/I:H/A:H). CISA's SSVC framework reinforces the nuance: Exploitation=none and Automatable=no, yet Technical Impact=total - meaning that when successfully exploited the consequences are complete, but exploitation is neither observed nor easily scriptable. There is no CISA KEV listing and no public POC in the provided data, and no EPSS score is supplied, so there is no quantitative exploitation-probability signal. The net picture is a high-severity spoofing/authentication-bypass issue whose AC:H (likely a man-in-the-middle position or a protocol race in the IKE handshake) materially constrains real-world weaponization. Priority is high because the affected footprint is essentially all supported Windows/Windows Server builds and a patch exists, but the AC:H plus SSVC Automatable=no argue this is more plausibly targeted/opportunistic MITM abuse than wormable mass exploitation. The 'Authentication Bypass' tag is consistent with the description's 'spoofing' impact and CWE-807 (an untrusted-input security decision leading to peer impersonation), so these signals do not conflict.

An attacker positioned on the network path between two IPsec/IKE peers injects crafted IKE messages that the Windows IKE Extension trusts when making a security decision, allowing the attacker to impersonate (spoof) a legitimate peer and subvert the authenticated tunnel. Because AC:H, the attacker needs a privileged network position or must win a handshake race rather than simply sending one packet. No public exploit identified at time of analysis, so this reflects the mechanism implied by the CVSS vector and description rather than a demonstrated exploit.