CVE-2023-21547

What it actually does

CVE-2023-21547 is a network-reachable denial-of-service vulnerability in the Windows Internet Key Exchange (IKE) implementation used for IPsec VPN and IPsec negotiation. An unauthenticated remote attacker can send specially crafted IKE traffic to an affected Windows host and cause availability impact to the IKE/IPsec service or the system component handling negotiation. The vulnerability has low attack complexity, requires no privileges or user interaction, and affects Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 systems that expose IKE/IPsec services, typically over UDP/500 and UDP/4500.

Why it matters to the business

Successful exploitation can interrupt VPN connectivity, IPsec-secured communications, site-to-site tunnels, remote access, or services that rely on Windows IPsec negotiation. For organizations using Windows systems as VPN endpoints, domain infrastructure with IPsec policies, or servers that depend on IPsec for transport protection, this can cause user access failures, degraded connectivity, and operational disruption. Although it is not listed in CISA KEV and has no known ransomware association in the provided data, the EPSS score is high, so internet-exposed IKE/IPsec endpoints should be treated as a priority for patching and monitoring.

How an attack unfolds

An attacker first identifies Windows systems reachable on IKE/IPsec ports, most commonly UDP/500 for IKE and UDP/4500 for NAT traversal. The attacker then sends crafted IKE protocol traffic designed to trigger the vulnerable code path in the Windows IKE implementation. Because exploitation does not require authentication, valid VPN credentials, or user interaction, any exposed vulnerable endpoint can be targeted directly from the network. If successful, the attack causes a denial-of-service condition affecting IKE/IPsec negotiation, which may disrupt VPN tunnels, IPsec-protected traffic, or the availability of the affected host’s IPsec services. Repeated traffic can be used to prolong the outage until the system is patched, the service is restored, or filtering blocks the malicious source.

How to fix it

Apply the Microsoft security updates that address CVE-2023-21547 for all affected Windows versions, including Windows 10 1607, 1809, 21H2, 22H2; Windows 11 21H2, 22H2; Windows Server 2016; Windows Server 2019; and Windows Server 2022. If immediate patching is not possible, reduce exposure by restricting UDP/500 and UDP/4500 to trusted peers only, disabling unused IPsec/VPN services, enforcing perimeter firewall allowlists for known VPN peer addresses, and rate-limiting or filtering suspicious IKE traffic. Systems that provide VPN, Remote Access, RRAS, site-to-site tunnels, or IPsec gateway functionality should be prioritized ahead of non-exposed endpoints.

How to confirm the fix worked

Confirm that the relevant Microsoft cumulative security update from January 2023 or later is installed for the affected Windows release. Validate exposure by checking whether the host is listening for IKE/IPsec traffic on UDP/500 or UDP/4500 and whether those ports are reachable from untrusted networks. Confirm that the IKE and AuthIP IPsec Keying Modules service is stable after patching and that VPN/IPsec tunnel negotiation works normally. Where possible, use authenticated vulnerability scanning or Windows patch inventory to verify that affected builds have been updated rather than relying only on port state.

Typical attack path

1. Scan for hosts exposing IKE/IPsec services on UDP/500 and UDP/4500.
2. Fingerprint likely Windows VPN, IPsec, or remote access endpoints.
3. Send specially crafted unauthenticated IKE packets to the exposed service.
4. Trigger a denial-of-service condition in the Windows IKE/IPsec handling component.
5. Repeat traffic to keep VPN/IPsec negotiation unavailable or unstable.

How to detect it

Look for evidence of attempted or successful denial-of-service against Windows IKE/IPsec services. Useful sources include Windows System logs, Windows Security logs if IPsec auditing is enabled, Microsoft-Windows-IKEEXT operational logs, Remote Access/RRAS logs where applicable, VPN gateway logs, firewall logs, IDS/IPS telemetry, and NetFlow. Focus on high-volume or malformed UDP/500 and UDP/4500 traffic, repeated IKE negotiation failures, repeated tunnel drops, and service instability involving IKEEXT or IPsec Policy Agent. Correlate inbound IKE traffic bursts from the same source with Windows service-control events such as unexpected IKEEXT termination, restart, or service hang. Because this is a denial-of-service vulnerability, compromise artifacts such as dropped files or persistence are not expected; detection should emphasize traffic anomalies, service crashes, and outage timing.

• UDP/500
• UDP/4500
• IKEEXT
• IKE and AuthIP IPsec Keying Modules
• IPsec Policy Agent
• PolicyAgent
• The IKE and AuthIP IPsec Keying Modules service terminated unexpectedly
• The IKEEXT service terminated unexpectedly
• The IPsec Policy Agent service terminated unexpectedly
• Service Control Manager
• Event ID 7031
• Event ID 7034
• Event ID 7023
• Main Mode negotiation failed
• Quick Mode negotiation failed
• IKE negotiation failed
• IPsec negotiation failed

What your security team should do

• Prioritize patching internet-facing Windows systems that expose UDP/500 or UDP/4500 for VPN, IPsec, RRAS, or site-to-site tunnel use.
• Restrict IKE/IPsec access at firewalls to known peer IP addresses and block unsolicited UDP/500 and UDP/4500 from untrusted networks.
• Review whether IPsec, RRAS, or VPN functionality is required on each Windows host and disable unnecessary exposure.
• Monitor for spikes in IKE traffic, repeated negotiation failures, IKEEXT service instability, or unexpected VPN/IPsec outages.
• Add detection logic for repeated UDP/500 or UDP/4500 traffic from a single source, especially when followed by IKEEXT service errors or tunnel failures.
• Include this issue in external attack surface reviews because the high EPSS score indicates elevated likelihood of exploitation despite no KEV listing in the provided data.