CVE-2026-69587

CVE-2026-69587 is a null pointer dereference (CWE-476) in the Windows IKE Extension, the in-box Windows component that performs Internet Key Exchange (IKE) negotiation for IPsec/VPN connections. An unauthenticated remote attacker can trigger the flaw by sending crafted IKE packets over the network, with no credentials or user interaction required. Successful exploitation crashes the IKE Extension service, resulting in denial of service only; the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms no confidentiality or integrity impact. Affected systems are Windows machines running and network-reachable via the IKE Extension, though the available data does not enumerate specific affected Windows editions or builds. As of this analysis there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 1.2% probability of exploitation within 30 days (66th percentile), so no in-the-wild exploitation is currently known.

What to do: Apply Microsoft's security update for CVE-2026-69587 when published, checking the Microsoft advisory for the affected editions, which were not enumerated in this data. As an interim mitigation, restrict IKE traffic (UDP ports 500 and 4500) at network boundaries to trusted peers and verify whether the IKEEXT service is running and reachable on exposed hosts. The impact is availability-only and services typically recover after a crash, but an attacker can re-trigger the condition with repeated packets, so prioritized patching of VPN/IPsec-exposed systems is recommended.