CVE-2026-50696

What it actually does

CVE-2026-50696 is a network-reachable heap-based buffer overflow in the Windows Internet Key Exchange implementation used for IPsec/IKE negotiation. An unauthenticated remote attacker can send specially crafted IKE traffic to an affected Windows host over UDP 500 and/or UDP 4500, causing memory corruption in the IKE processing path. The documented impact is denial of service: the IKE/AuthIP service or its hosting process may crash, disrupting IPsec VPN, site-to-site tunnel, DirectAccess, domain isolation, or other IPsec-dependent connectivity. The CVSS vector indicates low attack complexity, no privileges, no user interaction, network access, and high availability impact, with no stated confidentiality or integrity impact.

Why it matters to the business

Successful exploitation can interrupt VPN and IPsec-protected communications, potentially disconnecting remote users, breaking site-to-site connectivity, disrupting secure server-to-server traffic, and causing operational outages on Windows clients and servers. Because the flaw is unauthenticated and network-accessible, internet-exposed VPN/IPsec endpoints and systems reachable from untrusted networks are the highest-risk assets. The vulnerability is not currently listed in CISA KEV, has no known ransomware association, and has low EPSS at this time, but affected Windows versions are broadly deployed across workstations and servers, so exposure can be widespread in large environments.

How an attack unfolds

An attacker first identifies Windows systems that accept IKE/IPsec negotiation traffic, typically by discovering hosts with UDP 500 or UDP 4500 reachable. The attacker then sends malformed or oversized IKE packets designed to trigger the heap-based buffer overflow during protocol parsing. Because authentication is not required before the vulnerable parsing occurs, the attacker does not need valid VPN, domain, or local credentials. If the packet reaches a vulnerable and unpatched system, the IKE processing component can corrupt heap memory and crash the IKE/AuthIP service or the svchost.exe instance hosting it. The practical outcome is loss or instability of IPsec negotiation and dependent VPN or protected network sessions until the service restarts, the system recovers, traffic is filtered, or the host is patched.

How to fix it

Apply the relevant Microsoft security update for all affected Windows versions, including Windows 10 1809, 21H2, 22H2; Windows 11 24H2, 25H2, 26H1; Windows Server 2019, 2022, and 2025. Where immediate patching is not possible, reduce exposure by blocking inbound UDP 500 and UDP 4500 from untrusted networks unless IPsec/IKE is explicitly required, restricting IKE access to known peer IP addresses, placing VPN/IPsec endpoints behind DDoS-aware perimeter controls, and monitoring for repeated IKE service failures. Avoid disabling IPsec/IKE services as a blanket mitigation unless business owners confirm that VPN, DirectAccess, domain isolation, or other dependent services are not required.

How to confirm the fix worked

Confirm remediation by verifying that affected Windows systems have the applicable Microsoft security update installed through Windows Update, WSUS, Microsoft Update Catalog, endpoint management tooling, or PowerShell-based patch inventory. Validate exposure by checking whether UDP 500 and UDP 4500 are reachable from untrusted networks and whether firewall rules restrict IKE traffic to expected peers. Confirm operational health by reviewing that the IKE and AuthIP IPsec Keying Modules service is running normally after patching and that VPN/IPsec tunnel establishment still succeeds. For high-risk externally reachable hosts, perform controlled network validation from an approved scanner to confirm unnecessary IKE exposure is closed.

Typical attack path

1. Scan or enumerate targets that expose IKE/IPsec services on UDP 500 and/or UDP 4500.
2. Confirm that the target appears to be a Windows host or VPN/IPsec endpoint running an affected Windows release.
3. Send crafted IKE negotiation packets that exercise the vulnerable heap buffer handling path.
4. Trigger a crash or instability in the IKE/AuthIP IPsec processing service.
5. Repeat traffic to cause persistent denial of service or disrupt VPN/IPsec-dependent business operations.

How to detect it

Look for evidence of denial-of-service attempts against Windows IKE/IPsec services. Key log sources include Windows System logs, Application logs, Microsoft-Windows-IKEEXT operational logs if enabled, Windows Defender Firewall logs, Windows Filtering Platform/Security events, VPN/IPsec gateway logs, perimeter firewall logs, NetFlow, and EDR process telemetry. Hunt for bursts of inbound UDP 500 or UDP 4500 traffic from unknown or high-volume sources, followed by IKE negotiation failures, IKEEXT service crashes, svchost.exe application crashes, or Windows Error Reporting entries referencing ikeext.dll. In host telemetry, focus on unexpected termination or restart of the IKE and AuthIP IPsec Keying Modules service. In network telemetry, investigate repeated malformed IKE negotiation attempts, unusually high IKE packet rates, source IP rotation, or traffic targeting multiple Windows servers. Because public exploit maturity is currently reported as none and the known impact is denial of service, detections should emphasize service instability correlated with suspicious IKE traffic rather than post-exploitation behavior.

• UDP/500
• UDP/4500
• Microsoft-Windows-IKEEXT
• IKEEXT
• IKE and AuthIP IPsec Keying Modules
• The IKE and AuthIP IPsec Keying Modules service terminated unexpectedly
• Faulting application name: svchost.exe
• Faulting module name: ikeext.dll
• C:\Windows\System32\ikeext.dll
• C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_svchost.exe
• Main Mode negotiation failed
• Quick Mode negotiation failed
• Service Control Manager
• Event ID 7031
• Event ID 1000

What your security team should do

• Prioritize patching internet-facing VPN, IPsec gateway, remote access, and perimeter-adjacent Windows systems before internal-only endpoints.
• Inventory Windows systems that expose UDP 500 or UDP 4500 and classify whether exposure is required for business operations.
• Restrict IKE/IPsec traffic at firewalls to approved peer IP addresses wherever possible.
• Monitor for crashes or restarts of the IKE and AuthIP IPsec Keying Modules service, especially when preceded by spikes in UDP 500 or UDP 4500 traffic.
• Create SIEM detections for repeated IKE negotiation failures, svchost.exe crashes involving ikeext.dll, and Service Control Manager events indicating unexpected IKEEXT termination.
• Add this issue to standard Windows patch compliance reporting for the affected client and server versions.
• If exploitation is suspected, preserve Windows Event Logs, firewall logs, VPN concentrator logs, packet metadata, and Windows Error Reporting crash artifacts before rebooting or reimaging systems.