CVE-2022-34721: Windows IKE Protocol Extensions Remote Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction, and a very high EPSS score make this a top remediation priority despite no KEV listing.

What it is

CVE-2022-34721 is a remote code execution flaw in the Windows Internet Key Exchange (IKE) Protocol Extensions. It affects a broad set of Windows client and server releases, and the record gives no root-cause detail beyond the CWE being unspecified. Because it is network-reachable with no privileges or user interaction, it is a serious pre-authentication risk to any host exposing IKE.

Impact

A successful attacker can execute arbitrary code on the target Windows system, potentially gaining full control of the host. Given the CVSS scope is unchanged, the compromise is limited to the vulnerable machine rather than the whole environment.

Attack surface

Reached over the network via the IKE protocol extensions, per the AV:N vector, with no authentication (PR:N) and no user interaction (UI:N) required. Any Windows host with IKE/IPsec services reachable from an untrusted network is exposed.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is very high at roughly 0.789 (99.6th percentile), indicating strong predicted exploitation activity. The only references are Microsoft's advisory, with no public exploit or PoC tags provided.

What to do

• Apply the Microsoft security update for CVE-2022-34721 to all affected Windows versions as the first action.
• Restrict IKE (UDP 500/4500) exposure to trusted networks and block it at the perimeter where IPsec is not required.
• Disable or avoid unnecessary IKE/IPsec services on internet-facing hosts.
• Monitor Microsoft advisories for updated guidance and any revised affected-version list.

Detection

• Monitor network traffic for anomalous or malformed IKE packets to UDP 500 and 4500.
• Alert on unexpected IKE negotiation attempts from external or untrusted source addresses.
• Review Windows event logs and IPsec/IKE service logs for crashes or unusual errors on exposed hosts.
• Inventory Windows assets running IKE/IPsec and verify patch status against the Microsoft advisory.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.