Windows IKE Extension: Spoofing due to insufficient access control

Summary

A spoofing vulnerability in the Windows IKE Extension (IKEEXT) service, classified as CWE-1220 (insufficient granularity of access control), allows an authorized local attacker to spoof. Microsoft as CNA rates the flaw at CVSS 3.1 7.5 (High), and Microsoft itself rates it Important. The attacker needs local access with low privileges and high attack complexity, and because of the scope change the impact can reach other components. No exploitation has been observed and no public proof of concept is known.

Affected

• Windows 10 Version 1607: before 10.0.14393.9688
• Windows 10 Version 1809: before 10.0.17763.9487
• Windows 10 Version 21H2: before 10.0.19044.7846
• Windows 10 Version 22H2: before 10.0.19045.7846
• Windows 11 Version 23H2: before 10.0.22631.7711
• Windows 11 Version 24H2: before 10.0.26100.9974
• Windows 11 Version 25H2: before 10.0.26200.9974
• Windows 11 Version 26H1: before 10.0.28000.3501
• Windows 11 Version 26H2: before 10.0.26300.9974
• Windows Server 2016 (including Server Core): before 10.0.14393.9688
• Windows Server 2019 (including Server Core): before 10.0.17763.9487
• Windows Server 2022: before 10.0.20348.5870
• Windows Server 2025 is not listed in the CVE record; verify against MSRC.

Fixed in

• Install the November 2026 Patch Tuesday security updates that bring the builds above or higher.
• KB numbers: Unknown. Check the MSRC Security Update Guide.

Workaround

• Unknown. No workaround is confirmed by the CVE record.
• If the device tunnel and the IKEv2 user tunnel are not used, block the IKEv2 ports at the edge firewall, after confirming the port list in Microsoft guidance.

Exploitation

• No evidence of exploitation in the wild or public proof of concept. The CVSS temporal vector marks exploit code maturity as unproven (E:U).
• Separate issue: CISA added a different critical unauthenticated RCE in Windows IKE Extension (April 2026 Patch Tuesday) to its KEV catalog. Its CVE ID is not given in the sources.

Our recommendation

• Check whether the IKEEXT service is in use, for example IKEv2 VPN or Always On VPN device tunnel, on Windows hosts.
• Install the November 2026 cumulative updates on affected hosts in the next maintenance window and verify the builds against MSRC.
• On hosts that do not need IKEv2, restrict IKE ports at the perimeter.
• Make sure IKE hosts are also patched against the separate KEV-listed IKE RCE.
• Monitor MSRC and CISA KEV for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-122169 msrc.microsoft.com
• CVE Record CVE-2026-122169 (CVE.org) www.cve.org
• Richard Hicks: Always On VPN security updates, November 2026 directaccess.richardhicks.com
• Strix: CVE-2026-122169 (third-party aggregator, unverified builds) www.strix.ai
• BleepingComputer: CISA adds critical Windows IKE Extension flaw to KEV www.bleepingcomputer.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:18.