CVE-2022-34721
published 2022-09-13CVE-2022-34721: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
PriorityP190critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
75.71%
99.5th percentile
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
Affected
41 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.19444 | 10.0.10240.19444 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.5356 | 10.0.14393.5356 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.3406 | 10.0.17763.3406 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.3406 | 10.0.17763.3406 |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < 10.0.19042.2006 | 10.0.19042.2006 |
| microsoft | windows_10_version_21h1 | >= 10.0.0 < 10.0.19043.2006 | 10.0.19043.2006 |
| microsoft | windows_10_version_21h2 | >= 10.0.19043.0 < 10.0.19044.2006 | 10.0.19044.2006 |
| microsoft | windows_11_version_21h2 | >= 10.0.0 < 10.0.22000.978 | 10.0.22000.978 |
| microsoft | windows_7 | >= 6.1.0 < 6.1.7601.26115 | 6.1.7601.26115 |
| microsoft | windows_7_service_pack_1 | >= 6.1.0 < 6.1.7601.26115 | 6.1.7601.26115 |
| microsoft | windows_8.1 | >= 6.3.0 < 6.3.9600.20571 | 6.3.9600.20571 |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.26115 | 6.1.7601.26115 |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.6003.0 < 6.0.6003.21666 | 6.0.6003.21666 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.23865 | 6.2.9200.23865 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.20571 | 6.3.9600.20571 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.5356 | 10.0.14393.5356 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.3406 | 10.0.17763.3406 |
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.1006 | 10.0.20348.1006 |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerability is only exploitable via IKEv1 packets; monitor for IKEv1 traffic (UDP port 500/4500) targeting Windows hosts with IPSec enabled ↗
- →Attack vector is a specially crafted IP packet sent to a Windows host with IPSec enabled; detect anomalous/malformed IKE packets destined to IPSec-enabled Windows systems ↗
- →Check whether the 'Ikeext' (IKE and AuthIP IPsec Keying Modules) service is running on Windows hosts to identify exposed systems; use 'Get-Service Ikeext' or 'sc query ikeext' ↗
- ·All Windows Servers accept both IKEv1 and IKEv2 packets by default, making them all potentially exposed even though only IKEv1 is the vulnerable path ↗
- ·Disabling or stopping the 'Ikeext' service mitigates the vulnerability but may negatively impact IPSec functionality; patching is the recommended remediation ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
vendor_msrc9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-j7cj-c4wm-98jp: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
ghsa_unreviewed·2022-09-14·CVSS 9.8
CVE-2022-34722 [CRITICAL] GHSA-j7cj-c4wm-98jp: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-34721.
GHSA
GHSA-hppf-3fwv-wwmm: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
ghsa_unreviewed·2022-09-14·CVSS 9.8
CVE-2022-34721 [CRITICAL] GHSA-hppf-3fwv-wwmm: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-34722.
VulnCheck
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution
vulncheck·2022·CVSS 9.8
CVE-2022-34721 [CRITICAL] Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
Affected: Microsoft Windows
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.cyfirma.com/blogs/windows-internet-key-exchange-ike-remote-code-execution-vulnerability-analysis/; https://rt-solar.ru/solar-4rays/blog/4333/; https://rt-solar.ru/solar-4rays/blog/4527/
Exploit PoC: https://vulncheck.com/xdb/781d1207df8f
Microsoft
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
vendor_msrc·2022-09-13·CVSS 9.8
CVE-2022-34721 [CRITICAL] Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
FAQ: How could an attacker exploit this vulnerability?
An unauthenticated attacker could send a specially crafted IP packet to a target machine that is running Windows and has IPSec enabled, which could enable a remote code execution exploitation.
FAQ: Does this vulnerability affect all versions of Internet Key Exchange (IKE) Protocol?
No, this vulnerability only impacts IKEv1. IKEv2 is not impacted. However, all Windows Servers are affected because they accept both V1 and V2 packets.
Windows IKE Extension: Windows IKE Extension
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Remote Code Execution
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitati
No detection rules found.
No public exploits indexed.
Krebs
Wormable Flaw, 0days Lead Sept. 2022 Patch Tuesday
blogs_krebs·2022-09-14·CVSS 7.8
[HIGH] Wormable Flaw, 0days Lead Sept. 2022 Patch Tuesday
This month’s Patch Tuesday offers a little something for everyone, including security updates for a zero-day flaw in Microsoft Windows that is under active attack, and another Windows weakness experts say could be used to power a fast-spreading computer worm. Also, Apple has also quashed a pair of zero-day bugs affecting certain macOS and iOS users, and released iOS 16 , which offers a new privacy and security feature called “ Lockdown Mode .” And Adobe axed 63 vulnerabilities in a range of products.
Microsoft today released software patches to plug at least 64 security holes in Windows and related products. Worst in terms of outright scariness is CVE-2022-37969 , which is a “privilege escalation” weakness in the Windows Common Log File System Driver that allows attackers to gain SYSTEM-l
Talos
Microsoft Patch Tuesday for September 2022 — Snort rules and prominent vulnerabilities
blogs_talos·2022-09-13·CVSS 8.8
[HIGH] Microsoft Patch Tuesday for September 2022 — Snort rules and prominent vulnerabilities
## Microsoft Patch Tuesday for September 2022 — Snort rules and prominent vulnerabilities
Microsoft released its monthly security update Tuesday, disclosing 64 vulnerabilities across the company’s hardware and software line, a sharp decline from the record number of issues Microsoft disclosed last month.
September's security update features five critical vulnerabilities, 10 fewer than were included in last month’s Patch Tuesday. There are two moderate-severity vulnerabilities in this release and a low-security issue that’s already been patched as a part of a recent Google Chromium update. The remainder is considered “important.”
The most serious vulnerability exists in several versions of Windows Server and Windows 10 that could allow an attacker to gain the ability to execute remote co
Tenable
Microsoft’s September 2022 Patch Tuesday Addresses 62 CVEs (CVE-2022-37969)
blogs_tenable·2022-09-13·CVSS 7.8
[HIGH] Microsoft’s September 2022 Patch Tuesday Addresses 62 CVEs (CVE-2022-37969)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
September 2022 Patch Tuesday | Microsoft Releases 63 Vulnerabilities With 5 Critical, Plus 16 Microsoft Edge (Chromium-Based); Adobe Releases 7 Advisories, 63 Vulnerabilities With 35 Critical.
blogs_qualys·2022-09-13·CVSS 5.6
[MEDIUM] September 2022 Patch Tuesday | Microsoft Releases 63 Vulnerabilities With 5 Critical, Plus 16 Microsoft Edge (Chromium-Based); Adobe Releases 7 Advisories, 63 Vulnerabilities With 35 Critical.
## Table of Contents
Microsoft Patch Tuesday Summary
The September 2022 Microsoft Vulnerabilities Are Classified As Follows:
Notable Microsoft Vulnerabilities Patched
Zero-Day Vulnerabilities Addressed
Microsoft Important Vulnerability Highlights
Microsoft Edge | Last But Not Least
Adobe Security Bulletins and Advisories
About Qualys Patch Tuesday
Qualys Threat Protection High-Rated Advisories from August to September 2022 Patch Tuesday Advisory
Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response (VMDR)
Rapid Response With Patch Management (PM)
Evaluate Vendor-Suggested Workarounds With Policy Compliance
Qualys This Month in Vulnerabilities and Patches Webinar Series
Join the Webinar This Month in Vulnerabilities & Patches
NEW & NOTEWORTHY
Talos
Microsoft Patch Tuesday for September 2022 — Snort rules and prominent vulnerabilities
blogs_talos·2022-09-13·CVSS 8.8
[HIGH] Microsoft Patch Tuesday for September 2022 — Snort rules and prominent vulnerabilities
Microsoft released its monthly security update Tuesday, disclosing 64 vulnerabilities across the company’s hardware and software line, a sharp decline from the record number of issues Microsoft disclosed last month.
September's security update features five critical vulnerabilities, 10 fewer than were included in last month’s Patch Tuesday. There are two moderate-severity vulnerabilities in this release and a low-security issue that’s already been patched as a part of a recent Google Chromium update. The remainder is considered “important.”
The most serious vulnerability exists in several versions of Windows Server and Windows 10 that could allow an attacker to gain the ability to execute remote code (RCE) by sending a singular, specially crafted IPv6 packet to a Windows node where IPSec
Qualys
September 2022 Patch Tuesday | Microsoft Releases 63 Vulnerabilities With 5 Critical, Plus 16 Microsoft Edge (Chromium-Based); Adobe Releases 7 Advisories, 63 Vulnerabilities With 35 Critical. | Qualy
blogs_qualys·2022-09-13·CVSS 5.6
[MEDIUM] September 2022 Patch Tuesday | Microsoft Releases 63 Vulnerabilities With 5 Critical, Plus 16 Microsoft Edge (Chromium-Based); Adobe Releases 7 Advisories, 63 Vulnerabilities With 35 Critical. | Qualy
#### Table of Contents
- Microsoft Patch Tuesday Summary
- The September 2022 Microsoft Vulnerabilities Are Classified As Follows:
- Notable Microsoft Vulnerabilities Patched
- Zero-Day Vulnerabilities Addressed
- Microsoft Important Vulnerability Highlights
- Microsoft Edge | Last But Not Least
- Adobe Security Bulletins and Advisories
- About Qualys Patch Tuesday
- Qualys Threat Protection High-Rated Advisories from August to September 2022 Patch Tuesday Advisory
- Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response (VMDR)
- Rapid Response With Patch Management (PM)
- Evaluate Vendor-Suggested Workarounds With Policy Compliance
- Qualys This Month in Vulnerabilities and Patches Webinar Series
- Join the Webinar This Month in Vulnerabilities & Patches
-
Krebs
Wormable Flaw, 0days Lead Sept. 2022 Patch Tuesday
blogs_krebs·2022-09-13·CVSS 7.8
[HIGH] Wormable Flaw, 0days Lead Sept. 2022 Patch Tuesday
This month’s Patch Tuesday offers a little something for everyone, including security updates for a zero-day flaw in Microsoft Windows that is under active attack, and another Windows weakness experts say could be used to power a fast-spreading computer worm. Also, Apple has also quashed a pair of zero-day bugs affecting certain macOS and iOS users, and released iOS 16, which offers a new privacy and security feature called “Lockdown Mode.” And Adobe axed 63 vulnerabilities in a range of products.
Microsoft today released software patches to plug at least 64 security holes in Windows and related products. Worst in terms of outright scariness is CVE-2022-37969, which is a “privilege escalation” weakness in the Windows Common Log File System Driver that allows attackers to gain SYSTEM-level
Crowdstrike
September Patch Tuesday 2022: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] September Patch Tuesday 2022: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
2022-09-13
Published
Exploited in the wild