Microsoft Windows IKE Extension: Information disclosure via out-of-bounds read

Summary

An out-of-bounds read in the Windows IKE Extension, which handles IPsec key negotiation, allows an unauthenticated remote attacker to disclose information. No user interaction or privileges are required. The highest exposure is on Windows hosts that accept IKE traffic from untrusted networks, such as IPsec or VPN gateways. The CVE does not directly enable code execution or denial of service.

Affected

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045 branch (the CNA range lists 19044 and the aggregator mirror shows a typo; verify on MSRC)
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2 and 25H2: before 10.0.26100.9711 and 10.0.26200.9711
• Windows 11 Version 26H1: before 10.0.28000.3231
• Windows 11 Version 26H2: before 10.0.26300.9711
• Windows Server 2012 and 2012 R2 (including Server Core): before 6.2.9200.26434 and 6.3.9600.23470
• Unknown whether all listed builds are still supported or covered by ESU for your systems.

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 or later, as part of the October 2026 security update (KB5126868 according to Tenable)
• Other products: the builds listed under affected, or later, from the MSRC Security Update Guide
• Install the update for your specific product from the MSRC advisory.

Workaround

• No vendor-published interim mitigation found. A patch is available for supported builds.
• If IKE/IPsec is not needed, disable the IKE/IPsec service or the related VPN role (general measure, not from a vendor source).
• If it is needed, restrict UDP 500 and 4500 to known peers at the firewall.

Exploitation

• No confirmed exploitation in the wild found. CISA SSVC lists exploitation as none.
• No public proof-of-concept found.
• EPSS 0.01005, a low predicted exploitation probability.
• The CVE was published only recently; check CISA KEV and the vendor advisory for updates.

Our recommendation

• Patch Windows 10 1607 and Server 2016 hosts first if IPsec or VPN services are exposed to the internet or untrusted networks.
• Patch other affected Windows hosts in the normal update cycle.
• Check whether IKE/IPsec or VPN roles are enabled and restrict UDP 500 and 4500 to known peers.
• Confirm the fixed build against the MSRC advisory and check support or ESU status before relying on the patch.
• Monitor for public exploit code and KEV entries.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-103569 msrc.microsoft.com
• Tenable plugin 365471: Windows 10 1607 / Server 2016 update (October 2026) www.tenable.com
• CVE record mirror (threatint) cve.threatint.com
• NVD mirror (Vulners): CVE-2026-103569 vulners.com
• Strix AI mirror: CVE-2026-103569 www.strix.ai
• Senserva Patch Tuesday overview senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:37.