IT SBIT Services
Schneeberger
DEEN
CVE tracker

Windows IKE Extension: Spoofing due to reliance on untrusted inputs

CVE-2026-83522High 8.1

← All vulnerabilities

Summary

The Windows IKE Extension, which handles IKE key exchange for IPsec and VPN tunnels, contains a spoofing vulnerability. It arises because a security decision relies on untrusted inputs. A remote attacker on the network can exploit it without privileges or user interaction. CVSS 3.1 rates it 8.1 (High) with high attack complexity; Microsoft classifies the impact as Spoofing, while the vector rates confidentiality, integrity and availability as high. Hosts that accept IKE/IPsec traffic from the internet are most at risk.

Affected

  • Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
  • Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
  • Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
  • Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
  • Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
  • Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
  • Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
  • Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
  • Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
  • Windows Server 2012 (incl. Server Core): 6.2.9200.0 to before 6.2.9200.26434
  • Windows Server 2012 R2 (incl. Server Core): 6.3.9600.0 to before 6.3.9600.23470
  • Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612
  • Unknown: Windows Server 2019, 2022 and 2025 are not listed in the CNA record.

Fixed in

  • Fixed in Microsoft's October 2026 security update, according to the CNA record: builds at or above the thresholds listed under affected.
  • KB numbers: Unknown. Verify them in the MSRC advisory before rollout.

Workaround

Unknown. No vendor workaround or mitigation was found. Patching is the primary action.

Exploitation

  • In the wild: nothing known.
  • CISA SSVC: exploitation none, not automatable, technical impact total.
  • CISA KEV: not listed (per OpenCVE).
  • Public PoC: none found in the research; re-check later.
  • EPSS: about 0.008 (under 1%).

Our recommendation

  • Patch affected Windows hosts with the October 2026 update, starting with IKE/IPsec VPN gateways and site-to-site tunnel endpoints.
  • Check exposure: identify hosts that accept IKE/IPsec traffic from the internet and restrict access where possible.
  • Confirm KB numbers and fixed builds in the MSRC advisory, and check the lifecycle status of legacy builds such as Windows 10 1607 and Server 2012/2016.
  • Monitor for unusual IKE traffic and for newly published exploit code.

Information from Microsoft (Patch Tuesday October 2026)

Severity (Microsoft)
Important
Impact
Spoofing – Windows IKE Extension
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation unlikely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5126651, KB5126655, KB5126657, KB5126646, KB5127648, KB5126653

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:27.

Original description (NVD)

Reliance on untrusted inputs in a security decision in Windows IKE Extension allows an unauthorized attacker to perform spoofing over a network.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed