CVE-2022-21849: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability

CVE-2022-21849 is a remote code execution vulnerability in Windows Internet Key Exchange (IKE) Protocol Extensions, rated Important by Microsoft, with a CVSS 3.1 base score of 9.8 (Critical). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 6.59% probability of exploitation activity in the next 30 days, higher than 94% of all scored vulnerabilities. Microsoft released the fix on 11 January 2022 in the January 2022 Patch Tuesday, delivered through 7 security updates (KB5009557, KB5009545, KB5009543, KB5009555 and more). It affects 27 products in 1 product family (Windows).

Key facts

CVE ID

CVE-2022-21849

Severity

Critical CVSS 9.8

Microsoft severity

Important

Impact

Remote Code Execution

Exploited in the wild

No

Publicly disclosed

No

Exploitation likelihood

Less Likely

EPSS

6.59% (percentile 94%)

CISA KEV

Not listed

Released

11 January 2022

Last updated

11 January 2022

Patch Tuesday

January 2022 Patch Tuesday

Product families

Windows

CVSS score and vector

Microsoft scores CVE-2022-21849 at 9.8 (temporal 8.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Frequently asked questions (Microsoft)

How could an attacker exploit this vulnerability?

In an environment where Internet Key Exchange (IKE) version 2 is enabled, a remote attacker could trigger multiple vulnerabilities without being authenticated.

Mitigations and workarounds

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors might be helpful in your situation:

Only systems with the IKE and AuthIP IPsec Keying Modules running are vulnerable to this attack.

You can run either of the following commands to check the running status of this service:

PS: C:\> Get-Service Ikeext

• OR

Cmd: C:\> sc query ikeext

This mitigation could have negative affects on your IPSec functionality. Microsoft strongly recommends updating your system with the latest Windows security updates.

Affected products (27)

Windows

Security updates (7)

• KB5009557 (Security Update)
• KB5009545 (Security Update)
• KB5009543 (Security Update)
• KB5009555 (Security Update)
• KB5009566 (Security Update)
• KB5009585 (Security Update)
• KB5009546 (Security Update)

NIST NVD data

NVD status

Modified

NVD CVSS

9.8 (CRITICAL)

Published to NVD

11 January 2022

NVD last modified

17 June 2026

Affected configurations (CPE)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21849
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21849

Acknowledgments

• Polar Bear

Revision history

Related vulnerabilities

Other Windows Internet Key Exchange (IKE) Protocol Extensions vulnerabilities

• CVE-2026-69429: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability (High, CVSS 7.5, September 2026)
• CVE-2023-28238: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability (High, CVSS 7.5, April 2023)
• CVE-2022-34722: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability (Critical, CVSS 9.8, September 2022)
• CVE-2022-34721: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability (Critical, CVSS 9.8, September 2022)
• CVE-2022-21843: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability (High, CVSS 7.5)

More from the January 2022 Patch Tuesday

• CVE-2013-3900: WinVerifyTrust Signature Validation Vulnerability (Medium, CVSS 5.5, exploited)
• CVE-2022-21882: Win32k Elevation of Privilege Vulnerability (High, CVSS 7, exploited)
• CVE-2022-21919: Windows User Profile Service Elevation of Privilege Vulnerability (High, CVSS 7)
• CVE-2022-21836: Windows Certificate Spoofing Vulnerability (High, CVSS 7.8)
• CVE-2022-21874: Windows Security Center API Remote Code Execution Vulnerability (High, CVSS 7.8)
• CVE-2022-21907: HTTP Protocol Stack Remote Code Execution Vulnerability (Critical, CVSS 9.8)
• CVE-2022-21885: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-21897: Windows Common Log File System Driver Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-21908: Windows Installer Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-21914: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-21916: Windows Common Log File System Driver Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-21881: Windows Kernel Elevation of Privilege Vulnerability (High, CVSS 7)

All vulnerabilities of this release: January 2022 Patch Tuesday

Sources

• Microsoft Security Update Guide: CVE-2022-21849
• NIST NVD: CVE-2022-21849
• CVE.org record: CVE-2022-21849