CVE-2023-21758

What it actually does

CVE-2023-21758 is a network-reachable denial-of-service vulnerability in the Windows Internet Key Exchange (IKE) extension, which is used by Windows IPsec and VPN-related functionality. An unauthenticated remote attacker can send specially crafted IKE traffic to a vulnerable Windows system and cause loss of availability of the affected service or system component. The CVSS vector indicates no authentication, no user interaction, low attack complexity, and high availability impact, with no direct confidentiality or integrity impact.

Why it matters to the business

Successful exploitation can disrupt VPN, IPsec, and related secure connectivity services on Windows endpoints and servers, potentially interrupting remote access, site-to-site connectivity, administrative access paths, and services that depend on IPsec. Because the issue is remotely exploitable without credentials and has a high EPSS score, internet-exposed or perimeter-adjacent Windows systems that process IKE traffic should be treated as higher priority even though the vulnerability is not currently listed in CISA KEV and is not marked as ransomware-associated.

How an attack unfolds

An attacker identifies Windows systems that accept IKE/IPsec traffic, typically on UDP ports 500 and 4500. The attacker then sends crafted IKE packets designed to trigger the vulnerable code path in the Windows IKE extension. If the target is vulnerable, processing the malicious traffic can cause denial of service, disrupting IKE/IPsec functionality or impacting system availability. Exploitation does not require valid credentials or user interaction, making exposed VPN gateways, IPsec-enabled servers, and systems reachable from untrusted networks the most attractive targets. There is no indication from the provided data of code execution, data theft, or privilege escalation; the primary attacker objective is service disruption.

How to fix it

Apply the Microsoft security updates that address CVE-2023-21758 for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022. Because no fixed build numbers were provided, use the applicable Microsoft January 2023 or later cumulative security update for each supported Windows release. Prioritize systems that expose or process IKE/IPsec traffic, such as VPN servers, DirectAccess-related infrastructure, remote access servers, domain-joined servers using IPsec policies, and internet-facing Windows hosts. Where immediate patching is not possible, reduce exposure by restricting UDP/500 and UDP/4500 to trusted peers only, disabling unnecessary IPsec/IKE functionality, and applying perimeter firewall or DDoS protections to limit unsolicited IKE traffic.

How to confirm the fix worked

Confirm that each affected Windows host has installed the applicable Microsoft security update released for this vulnerability or a later cumulative update. Validate through centralized patch management, Windows Update history, Microsoft Update Compliance, endpoint management tooling, or by comparing OS build and installed KB levels against Microsoft guidance for the relevant Windows version. From an exposure perspective, verify whether UDP/500 and UDP/4500 are reachable from untrusted networks and confirm that only intended peers can communicate with IKE/IPsec services. Functional validation should include testing VPN or IPsec connectivity after patching and monitoring for service instability or unexpected restarts.

Typical attack path

1. Scan for hosts reachable on IKE/IPsec-related UDP services, especially UDP/500 and UDP/4500.
2. Fingerprint likely Windows VPN, IPsec, or IKE-capable systems.
3. Send specially crafted IKE traffic to the vulnerable Windows IKE extension.
4. Trigger a denial-of-service condition affecting IKE/IPsec processing or system availability.
5. Repeat traffic as needed to sustain disruption or cause recurring outages.

How to detect it

To assess whether exploitation may already have occurred, review network and host telemetry around Windows systems that process IKE/IPsec traffic. Key log sources include perimeter firewall logs, VPN concentrator logs, Windows Event Logs related to IPsec/IKE negotiation, Security logs for IPsec audit events, System logs for service failures or crashes, Windows Error Reporting events, and EDR telemetry showing crashes or restarts of IPsec/IKE-related components. Look for unusual bursts of UDP traffic to ports 500 or 4500, repeated failed IKE negotiations, malformed or unsupported IKE payloads, high-volume traffic from a small set of external IPs, and denial-of-service symptoms such as repeated service instability, VPN disconnects, or sudden loss of IPsec tunnel availability. Since this vulnerability causes denial of service rather than code execution, strong evidence is more likely to appear as abnormal IKE traffic patterns and correlated service failures rather than persistence artifacts or malware files.

• UDP/500
• UDP/4500
• IKEEXT
• IKEEXT service
• PolicyAgent
• IPsec Policy Agent
• Microsoft-Windows-IKE
• Microsoft-Windows-IPsec
• IKE authentication credentials are unacceptable
• No policy configured
• Main Mode negotiation failed
• Quick Mode negotiation failed
• The IKEEXT service terminated unexpectedly
• The IPsec Policy Agent service terminated unexpectedly
• port 500
• port 4500

What your security team should do

• Prioritize patching Windows systems that are internet-facing or reachable by untrusted networks on UDP/500 or UDP/4500.
• Inventory Windows servers and endpoints using IPsec, VPN, DirectAccess, or IKE-related functionality.
• Restrict IKE/IPsec traffic to known trusted peer addresses wherever operationally feasible.
• Monitor perimeter firewalls, VPN infrastructure, and Windows event logs for spikes in malformed, failed, or unusual IKE negotiation attempts.
• Review DDoS protections and rate-limiting options for exposed IKE/IPsec services.
• Confirm that cumulative Windows security updates from January 2023 or later are installed across affected Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 systems.
• Treat exposure as urgent where patching is incomplete because the EPSS score indicates a high likelihood of exploitation activity despite no current KEV listing.