CVE-2026-35424

What it actually does

CVE-2026-35424 is a remotely reachable denial-of-service flaw in the Windows Internet Key Exchange (IKE) protocol implementation. The issue is caused by memory not being released after its effective lifetime, allowing unauthenticated network traffic to trigger memory exhaustion or resource pressure in the Windows IKE/IPsec keying components. The vulnerability requires no authentication, no user interaction, and low attack complexity, and can impact systems exposing IKE services, typically over UDP port 500 and UDP port 4500 used for IPsec/IKE and NAT traversal. Successful exploitation affects availability only; it does not directly provide code execution, data theft, or privilege escalation.

Why it matters to the business

Exploitation can make affected Windows clients or servers unable to establish or maintain IPsec, VPN, or related secure network communications, and may degrade or interrupt the availability of the host or dependent services. The highest business risk is for internet-facing VPN gateways, remote-access infrastructure, site-to-site IPsec endpoints, domain or infrastructure servers using IPsec policies, and systems where IKE traffic is allowed from untrusted networks. Although the CVSS score is high for availability impact, current exploitation signals are lower: EPSS is 0.01187 and stable over 30 days, the vulnerability is not listed in CISA KEV, is not known to be used in ransomware campaigns, and public exploit maturity is reported as none. Organizations should still prioritize remediation for exposed Windows Server and VPN/IPsec-facing assets because the flaw is network-accessible and unauthenticated.

How an attack unfolds

An attacker first identifies Windows systems that expose IKE/IPsec services, most commonly by finding hosts that respond on UDP/500 or UDP/4500. The attacker then sends crafted or sustained IKE negotiation traffic designed to trigger the memory-release flaw in the Windows IKE implementation. Because authentication is not required, the traffic can be sent before any valid VPN or IPsec trust relationship is established. Repeated triggering can cause the affected IKE service process or the host to consume excessive memory or related resources, leading to service instability, failed IPsec negotiations, degraded VPN connectivity, service restarts, or broader denial of service. At present, there are no named threat actors, KEV listing, ransomware linkage, or mature public exploit indicators provided for this vulnerability, so defenders should focus on exposure reduction, patching, and looking for abnormal IKE traffic patterns rather than actor-specific tradecraft.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-35424 for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. No exact fixed build numbers were provided in the input, so use Microsoft Update, Windows Update for Business, WSUS, Configuration Manager, or the Microsoft Update Catalog to deploy the applicable cumulative update released for this issue or any later cumulative update. Prioritize internet-facing systems, VPN concentrators, site-to-site IPsec endpoints, remote-access servers, and servers where UDP/500 or UDP/4500 is reachable from untrusted networks. Where immediate patching is not possible, restrict UDP/500 and UDP/4500 to known peer IP addresses, block unsolicited IKE traffic at perimeter firewalls, apply rate limiting or DDoS controls, disable IPsec/IKE services where not required, and ensure redundant VPN or remote-access capacity exists for critical operations.

How to confirm the fix worked

Confirm that affected Windows assets have installed the relevant Microsoft cumulative security update or a later superseding update. Validate through enterprise patch tooling, Windows Update history, installed hotfix inventory, vulnerability scanner results, and OS build verification against Microsoft’s advisory for this issue. From a network perspective, identify systems where UDP/500 or UDP/4500 remains reachable from untrusted networks and verify that only expected peer addresses can reach them. For mitigation validation, test that unauthorized external sources cannot initiate IKE negotiation traffic, while legitimate VPN/IPsec peers still function. For operational validation, monitor IKE/IPsec service stability, memory consumption, and VPN connection success rates after patching or mitigation to ensure the denial-of-service condition is no longer reproducible.

Typical attack path

1. Scan for Windows systems or network gateways exposing IKE/IPsec services over UDP/500 and/or UDP/4500.
2. Confirm the target responds to IKE negotiation attempts or appears to support IPsec/VPN connectivity.
3. Send crafted or high-volume IKE protocol messages that trigger the memory-release flaw.
4. Repeat the traffic to accumulate unreleased memory or exhaust related resources.
5. Cause IKE/IPsec negotiation failures, VPN disruption, service instability, or host-level availability degradation.
6. Stop, vary, or resume traffic to evade simple rate-based blocking while continuing to create intermittent outages.

How to detect it

To determine whether this vulnerability may have already been exploited, review network, firewall, VPN, endpoint, and Windows event telemetry for abnormal IKE/IPsec activity. Focus on unexpected or high-volume UDP/500 and UDP/4500 traffic, repeated IKE negotiation attempts from unknown external IP addresses, sudden spikes in failed IPsec or VPN handshakes, and traffic patterns that coincide with service instability or outages. On Windows systems, examine System logs for Service Control Manager events showing the IKE and AuthIP IPsec Keying Modules service stopping, restarting, or terminating unexpectedly, and check Resource-Exhaustion-Detector events for memory pressure around the same timeframe. Review performance telemetry for unusual memory growth in the service host process running IKEEXT. If packet captures are available, look for repeated IKE_SA_INIT or IKE_AUTH exchanges, malformed or incomplete IKE negotiations, or sustained unauthenticated IKE traffic from a small set of sources. Correlate these findings with VPN disconnects, IPsec tunnel failures, helpdesk reports of remote-access disruption, and any firewall or DDoS alerts involving UDP/500 or UDP/4500. Because no public exploit maturity, KEV listing, ransomware use, or named threat actor activity is provided, detections should emphasize behavior and service impact rather than fixed malware indicators.

• UDP/500
• UDP/4500
• IKE_SA_INIT
• IKE_AUTH
• IKEEXT
• IKE and AuthIP IPsec Keying Modules
• The IKE and AuthIP IPsec Keying Modules service terminated unexpectedly
• The IKE and AuthIP IPsec Keying Modules service entered the stopped state
• Service Control Manager
• Event ID 7031
• Event ID 7034
• Resource-Exhaustion-Detector
• Event ID 2004
• Microsoft-Windows-Resource-Exhaustion-Detector
• Microsoft-Windows-IKE
• Microsoft-Windows-IKE/Operational
• svchost.exe -k netsvcs
• IPsec negotiation failed
• Main Mode negotiation failed
• Quick Mode negotiation failed

What your security team should do

• Inventory all Windows systems exposing IKE/IPsec services, especially those reachable over UDP/500 or UDP/4500 from the internet or partner networks.
• Patch internet-facing Windows VPN, IPsec, and remote-access servers first, followed by internal servers and client systems that use IPsec policies.
• Restrict UDP/500 and UDP/4500 to approved peer IP addresses wherever business requirements allow.
• Review firewall, VPN, and remote-access architecture for unnecessary IKE exposure and disable IKE/IPsec services on systems that do not need them.
• Add monitoring for abnormal IKE traffic volume, repeated negotiation failures, IKEEXT service instability, and resource-exhaustion events.
• Prepare operational runbooks for VPN or IPsec service degradation, including failover, traffic blocking, and emergency patch deployment.
• Because EPSS is low, stable, and the issue is not in KEV, prioritize based on exposure and business criticality rather than applying the same urgency to isolated or non-IKE-enabled endpoints.