Windows IKE Extension EUVD-2026-99950

Exploitation requires the target system to be running the Windows IKE Extension (IKEEXT) service - i.e., IPsec/IKE or Windows VPN functionality must be active and network-reachable - and the attacker must already possess low-level authorized network access (PR:L), not merely anonymous reachability. The attack is a buffer over-read (CWE-126) triggered by malformed IKE protocol input and results solely in denial of service (A:H; C:N/I:N); it cannot be used to read memory contents or execute code. Limiting factors: the required authorization level, the need for the IKE/IPsec service to be enabled and exposed, and the availability-only impact (transient service disruption, recoverable on restart/patch) rather than persistent compromise.

This is a moderate-priority DoS vulnerability, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) shows a network-reachable, low-complexity attack but one that requires low-level privileges (PR:L) and yields only availability impact - no confidentiality or integrity loss. All exploitation signals point away from urgency: SSVC reports Exploitation 'none', Automatable 'no', and Technical Impact only 'partial', and there is no CISA KEV listing and no public exploit identified. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The signals are internally consistent (authenticated DoS, not automatable, not exploited), so there is no major conflict to flag - the main caveat is that PR:L indicates the attacker already needs some authenticated/authorized network foothold, which materially limits real-world risk versus the raw 6.5 score. Prioritize patching in the normal Patch-Tuesday cycle rather than as an out-of-band emergency.

An attacker who already holds low-level authenticated network access to a target sends malformed IKE (Internet Key Exchange) packets to the Windows IKE Extension, triggering a buffer over-read that crashes or hangs the service and denies VPN/IPsec connectivity to legitimate users. Because CVSS is AC:L the malformed input is simple to craft, but PR:L means the attacker needs existing authorized access, and no public proof-of-concept exploit has been identified at time of analysis.