CVE-2022-21883

Deeper analysis

CVE-2022-21883 is a denial-of-service vulnerability in the Windows Internet Key Exchange (IKE) Extension. The flaw received a CVSS 3.1 base score of 7.5, reflecting a network-accessible attack that requires no authentication or user interaction and produces a high impact on availability while leaving confidentiality and integrity unaffected.

An unauthenticated remote attacker can send specially crafted network traffic to a vulnerable Windows system and trigger the IKE Extension to stop responding, resulting in a denial-of-service condition. Because the attack requires no privileges or user interaction, it can be launched from anywhere on the network that can reach the target IKE service.

Microsoft has published security advisories for CVE-2022-21883 that direct administrators to the corresponding security updates and configuration guidance.

The EPSS score for this CVE has remained flat at 0.0925 with no material increase after disclosure, and no reports of in-the-wild exploitation are referenced in the supplied data.