Reliance on Untrusted Inputs in a Security Decision in Microsoft Windows and Windows Server - CVE-2026-83522

Vulnerability details

The vulnerability allows a remote attacker to perform spoofing and alter or disrupt a protected connection.

The vulnerability exists due to reliance on untrusted inputs in a security decision in Windows IKE Extension when processing network packets associated with an existing IKEv2 security association. A remote attacker can send a specially crafted packet that is processed without required integrity verification to perform spoofing and alter or disrupt a protected connection.

Exploitation requires obtaining the identifiers for an existing IKEv2 security association. Successful exploitation requires a deep understanding of the system and depends on environmental factors, system configuration, and additional security measures. User interaction is not required.

Affected software

How to mitigate CVE-2026-83522

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83522

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Windows