CVE-2022-34721
Microsoft Windows 10 1607 … 21h2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2022-34721 is a critical-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2022-34721 is a remote code execution vulnerability in the Windows Internet Key Exchange (IKE) Protocol Extensions. It affects multiple versions of Windows that implement IKE for IPsec VPN connections and carries a CVSS 3.1 score of 9.8, reflecting network-accessible attack conditions with no required privileges or user interaction and full impact on confidentiality, integrity, and availability.
An unauthenticated attacker can send specially crafted IKE messages over the network to trigger the flaw, resulting in arbitrary code execution with the privileges of the IKE service and potential full system compromise.
Microsoft’s advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34721 directs administrators to install the security updates released on 13 September 2022 for the affected Windows releases; no workarounds are listed as sufficient.
The EPSS score reached a peak of 0.2748 and currently stands at 0.2660, indicating sustained moderate exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-37670
Vulnerability Data
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.