CVE-2026-50696: Windows IKEv2 AES-GCM Decryption Integer Underflow (ZDI-26-622) — Detection and Remediation Guide

The Zero Day Initiative has published ZDI-26-622, detailing a serious vulnerability in Microsoft Windows' IKEv2 (Internet Key Exchange version 2) implementation: an integer underflow in AES-GCM decryption that permits unauthenticated remote code execution. The flaw is tracked as CVE-2026-50696 and carries a CVSS score of 8.1.

Let me be precise about the risk calculus here, because it cuts both ways. The vulnerability requires no authentication and is reachable over the network — IKEv2 listens on UDP 500 and UDP 4500. That is the nightmare scenario profile. However — and this matters for triage — only systems with specific IPsec configurations are vulnerable. This is not a default-exposed, worm-every-Windows-box-on-earth bug. Your exposure is concentrated on systems actively running IKEv2/IPsec: VPN gateways, Always On VPN servers, RRAS hosts, site-to-site tunnel endpoints, and any server enforcing IPsec transport or tunnel mode policies.

An integer underflow in a decryption path is exactly the class of memory corruption bug that skilled exploit developers convert into reliable RCE primitives. If your organization terminates IKEv2 tunnels on Windows — and a significant number of enterprises do via RRAS and Always On VPN — treat this as a drop-everything patching event.

Technical Analysis

Affected Component and Attack Surface

The vulnerability resides in the Windows IKEv2 stack, serviced by the IKE and AuthIP IPsec Keying Modules (IKEEXT) service, which runs inside a svchost.exe instance. IKEEXT handles IKEv2 SA negotiation and, critically, the AES-GCM authenticated decryption of IKEv2 packets.

Affected platforms: Microsoft Windows installations running IKEEXT with IKEv2/IPsec configurations that negotiate AES-GCM as the integrity/encryption algorithm. Based on the advisory, the vulnerable population includes systems where:

• RRAS is configured for IKEv2 VPN termination (including Always On VPN deployments)
• IPsec policies (connection security rules) are enforced with AES-GCM transforms
• Site-to-site IKEv2 tunnels terminate on Windows

Systems with IKEEXT disabled and no IPsec policy enforcement are not meaningfully exposed.

Vulnerability Mechanics — Defender's View

An integer underflow occurs when an arithmetic operation on an unsigned integer wraps below zero, producing an enormous positive value. In a decryption routine, that typically means a length, offset, or size field derived from attacker-controlled packet data underflows during validation or buffer arithmetic. The classic downstream consequence: a bounds check passes when it shouldn't, and the decryption path reads or writes far outside the intended buffer — giving the attacker memory corruption with content they influence via the ciphertext they submit.

The attack chain from the wire looks like this:

1. Attacker sends crafted IKEv2 packets to UDP 500 / UDP 4500 — no credentials, no prior SA, no user interaction.
2. The target system, configured with AES-GCM in its IPsec/IKEv2 proposal, hands the packet to the vulnerable decryption routine in IKEEXT.
3. A length/size calculation underflows, producing memory corruption in the IKEEXT service context.
4. Successful exploitation yields arbitrary code execution, typically as the svchost service context (potentially SYSTEM-level privileges, since IKEEXT runs with elevated rights).

Because the vulnerable code path processes pre-authentication key-exchange traffic, there is no meaningful barrier between an internet-facing VPN endpoint and this bug. That is what elevates this from "important" to "urgent."

Severity, CVE, and Exploitation Status

• CVE: CVE-2026-50696
• Advisory: ZDI-26-622
• CVSS: 8.1 (High) — the score reflects network reachability and unauthenticated exploitation, tempered by the non-default configuration requirement and the inherent complexity of weaponizing an integer underflow into stable RCE.

At the time of writing, ZDI's disclosure indicates the vulnerability was reported to Microsoft and published as an advisory. There is no confirmed in-the-wild exploitation or public weaponized PoC cited in the advisory, and it has not been listed in the CISA Known Exploited Vulnerabilities catalog as of publication. That status can change quickly — historically, ZDI-published memory-corruption bugs in network-facing Windows services attract rapid reverse engineering once a patch diff is available. Assume a working exploit is a matter of when, not if, and patch before the n-day window closes.

Detection & Response

Pre-patch, your best signal is twofold: anomalous IKEv2 traffic volume (fuzzer-like or exploit-attempt patterns against UDP 500/4500) and IKEEXT service instability (repeated crashes are the canonical fingerprint of memory-corruption exploitation attempts against a service). A single crash might be noise; a crash loop correlated with external IKE traffic is an incident.

Sigma Rules

The following rules target (1) unexpected IKEEXT service termination/crash and (2) crash artifacts written by Windows Error Reporting for the IKEEXT host process. These are high-signal because IKEEXT is a stable service in normal operation — crashes are rare outside of exploitation attempts or genuine bugs.

---
title: IKEEXT Service Unexpected Termination or Crash
tid: 3f8a2c41-9b6e-4d27-a1c4-7e5f0b9d2a63
status: experimental
description: Detects unexpected stop, error, or crash events for the IKE and AuthIP IPsec Keying Modules (IKEEXT) service, which may indicate exploitation attempts against CVE-2026-50696 (IKEv2 AES-GCM decryption integer underflow).
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-622/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.exploit_public_facing_application
  - attack.t1190
logsource:
  product: windows
  service: system
detection:
  selection_service:
    Service_Name: 'IKEEXT'
  selection_event:
    EventType:
      - 'Error'
      - 'Warning'
  condition: selection_service and selection_event
falsepositives:
  - Legitimate service restarts during patching or IPsec reconfiguration
level: high
---
title: Windows Error Reporting Crash Artifact for IKEEXT Host Process
id: 8c1d4e72-5a09-4f3b-b6d8-2e7a1c0f4b95
status: experimental
description: Detects Windows Error Reporting artifacts referencing the IKEEXT service or its svchost host, indicating a service crash potentially caused by memory corruption exploitation of CVE-2026-50696.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-622/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\ProgramData\Microsoft\Windows\WER\ReportArchive\'
      - '\ProgramData\Microsoft\Windows\WER\ReportQueue\'
  selection_content:
    TargetFilename|contains:
      - 'ikeext'
      - 'svchost.exe_IKEEXT'
  condition: selection_path and selection_content
falsepositives:
  - Rare legitimate IKEEXT crashes due to unrelated software defects
level: high

KQL — Microsoft Sentinel / Defender

This query hunts for anomalous IKEv2 traffic concentration — a single remote source generating an unusually high volume of IKEv2 connection attempts to your Windows endpoints, which is consistent with fuzzing or exploit delivery against UDP 500/4500.

// Hunt for anomalous IKEv2 (UDP 500/4500) traffic patterns against Windows endpoints
// High connection counts from a single external source may indicate CVE-2026-50696 exploitation attempts
let threshold = 100;
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemotePort in (500, 4500) or LocalPort in (500, 4500)
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
| summarize ConnectionCount = count(),
            TargetedDevices = dcount(DeviceName),
            DeviceList = make_set(DeviceName, 10),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated)
    by RemoteIP, RemotePort
| where ConnectionCount > threshold
| sort by ConnectionCount desc;

// Correlate IKEEXT service crashes with recent IKEv2 traffic on the same device
DeviceEvents
| where TimeGenerated > ago(24h)
| where ActionType == "ServiceStopped" or AdditionalFields has "IKEEXT"
| where AdditionalFields has "IKEEXT"
| project TimeGenerated, DeviceName, ActionType, AdditionalFields
| join kind=inner (
    DeviceNetworkEvents
    | where TimeGenerated > ago(24h)
    | where RemotePort in (500, 4500) or LocalPort in (500, 4500)
    | summarize RecentIKEConnections = count(), SourceIPs = make_set(RemoteIP, 10) by DeviceName
) on DeviceName
| project TimeGenerated, DeviceName, ActionType, RecentIKEConnections, SourceIPs;

If you ingest perimeter firewall logs via CEF/Syslog into Sentinel, run the same source-concentration analysis against CommonSecurityLog filtering on DestinationPort in (500, 4500) and protocol UDP — this catches attempts against VPN gateways that may not be running Defender for Endpoint.

Velociraptor VQL

This hunt confirms whether IKEEXT is running on an endpoint (i.e., whether the attack surface is present) and enumerates active UDP 500/4500 listeners plus any recent WER crash artifacts for the service.

-- Identify IKEEXT service exposure and crash artifacts for CVE-2026-50696 triage
-- 1) Confirm IKEEXT host process is running
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'ikeext'
   OR Name =~ 'svchost'

-- 2) Enumerate UDP listeners on IKEv2 ports (500/4500)
SELECT Pid, Name, Family, Type, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE LocalPort in (500, 4500)

-- 3) Look for WER crash reports referencing IKEEXT
SELECT FullPath, Size, Mtime
FROM glob(globs='C:/ProgramData/Microsoft/Windows/WER/**')
WHERE FullPath =~ 'ikeext'
   OR FullPath =~ 'IKEEXT'
ORDER BY Mtime DESC

Deploy the netstat portion fleet-wide first — it is your fastest way to enumerate the actual vulnerable population: any Windows asset listening on UDP 500/4500 with IKEEXT active.

Remediation & Exposure Audit Script

Run this PowerShell on Windows servers to (1) determine whether the IKEEXT attack surface is active, (2) inventory IPsec policy configuration, and (3) apply the recommended workaround if IKEv2 is not operationally required on the host. Test the service-disable workaround before applying it to production VPN infrastructure.

# CVE-2026-50696 Exposure Audit and Mitigation - ZDI-26-622
# Run elevated. Review output before applying any changes.

# 1) Check IKEEXT service status
$svc = Get-Service -Name IKEEXT -ErrorAction SilentlyContinue
if ($svc) {
    Write-Host "[+] IKEEXT Status: $($svc.Status) | StartType: $($svc.StartType)" -ForegroundColor Yellow
} else {
    Write-Host "[-] IKEEXT service not present on this host." -ForegroundColor Green
}

# 2) Check for active UDP 500/4500 listeners (IKEv2 attack surface)
Write-Host "`n[+] UDP 500/4500 listeners:" -ForegroundColor Yellow
Get-NetUDPEndpoint -LocalPort 500,4500 -ErrorAction SilentlyContinue |
    Select-Object LocalAddress, LocalPort, OwningProcess |
    Format-Table -AutoSize

# 3) Inventory IPsec connection security rules and main mode crypto sets (look for AES-GCM)
Write-Host "`n[+] Active IPsec rules:" -ForegroundColor Yellow
Get-NetIPsecRule -ErrorAction SilentlyContinue |
    Where-Object { $_.Enabled -eq 'True' } |
    Select-Object DisplayName, Enabled, Action, Profile |
    Format-Table -AutoSize

Write-Host "`n[+] Main Mode cryptographic sets (check for GCM algorithms):" -ForegroundColor Yellow
Get-NetIPsecMainModeCryptoSet -ErrorAction SilentlyContinue |
    Select-Object DisplayName, Encryption, Integrity, KeyExchange |
    Format-Table -AutoSize

# 4) Check installed updates - confirm the Microsoft security update for CVE-2026-50696 is applied
# Verify against the KB listed in Microsoft's Security Update Guide entry for CVE-2026-50696
Write-Host "`n[+] Recent security updates installed:" -ForegroundColor Yellow
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 |
    Format-Table HotFixID, Description, InstalledOn -AutoSize

# 5) WORKAROUND (only if IKEv2/IPsec is NOT required on this host):
# Disabling IKEEXT removes the vulnerable code path from the network attack surface.
# DO NOT run this on RRAS/Always On VPN servers or IPsec policy enforcement points.
#
# Stop-Service -Name IKEEXT -Force
# Set-Service -Name IKEEXT -StartupType Disabled
# Write-Host "[!] IKEEXT disabled as workaround for CVE-2026-50696" -ForegroundColor Cyan

# 6) Enable IKEEXT operational logging for forensic visibility
wevtutil set-log "Microsoft-Windows-IKE/Operational" /enabled:true

Remediation

Primary action — patch immediately. Apply the Microsoft security update addressing CVE-2026-50696 as documented in the Microsoft Security Update Guide. ZDI-26-622 confirms coordinated disclosure, so the fix ships via the standard Windows cumulative update channel. Prioritize in this order:

1. Internet-facing RRAS / Always On VPN servers — these are unauthenticated-attacker-reachable and are the highest-value targets.
2. Site-to-site tunnel endpoints and domain-joined systems enforcing IPsec connection security rules with AES-GCM transforms.
3. All remaining Windows hosts running the IKEEXT service.

Workaround (pre-patch window): If a host does not require IKEv2/IPsec, disable the IKEEXT service. This fully removes the vulnerable attack surface. Audit first with the script above — blindly disabling IKEEXT on a VPN concentrator will terminate tunnels.

Compensating controls while patching:

• Restrict UDP 500/4500 ingress at the perimeter to known tunnel peer IP addresses only. IKEv2 gateways should never accept key-exchange traffic from arbitrary internet sources — if yours do, fix that today regardless of this CVE.
• If your IPsec policy permits, evaluate whether AES-GCM can be temporarily deprioritized in the cryptographic proposal in favor of an alternative suite until patching completes — though weigh interoperability impact carefully, and note this only reduces (does not eliminate) risk given the specific vulnerable code path.
• Enable IKEEXT operational logging and forward service crash events (crash loops on svchost hosting IKEEXT) to your SIEM with alerting. Memory-corruption exploitation attempts against this service will almost certainly produce crash telemetry before an attacker lands a reliable exploit.
• Hunt retroactively. Use the KQL and VQL above to check for IKEEXT crashes and anomalous IKEv2 source concentration over the past 30+ days. If you find a crash correlated with external IKE traffic on a VPN endpoint, treat it as a potential incident and investigate the host for post-exploitation activity — service context execution on a VPN gateway is a foothold on your network edge.

Advisory references:

• ZDI advisory: http://www.zerodayinitiative.com/advisories/ZDI-26-622/
• Microsoft Security Update Guide entry for CVE-2026-50696 (confirm the applicable KB for your OS builds)

Given the unauthenticated, network-reachable nature of this flaw against edge infrastructure, expect exploitation pressure to build as researchers diff the patch. The window between disclosure and weaponization for Windows network-service memory corruption has been consistently shrinking. Do not let your VPN gateways sit unpatched in that window.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub