CVE-2026-50696 Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability

Api.Msrc.Microsoft • September 8, 2026

We use optional cookies to improve your experience on our websites, such as through social media connections, and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services will be used. You may change your selection by clicking “Manage Cookies” at the bottom of the page. Privacy Statement Third-Party Cookies

Released: Jul 14, 2026

Last updated: Sep 8, 2026

Please see Common Vulnerability Scoring System for more information on the definition of these metrics.

Heap-based buffer overflow in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.

The following table provides an exploitability assessment for this vulnerability at the time of original publication.

Richard Chen of TrendAI Research

z1r0

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle .

Acknowledgement Updated

Updated an acknowledgement. This is an informational change only.

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Windows IKE Vulnerabilities Disclosed on September 8, 2026 On September 8, 2026, Microsoft disclosed four vulnerabilities related to the Internet Key Exchange (IKE) protocol. CVE-2026-69429 is a remote code execution vulnerability that requires an authorized attacker to exploit a heap-based buffer overflow. CVE-2026-50696, CVE-2026-69881, and CVE-2026-69587 are denial of service vulnerabilities that allow unauthorized attackers to disrupt services through null pointer dereferences and heap-based buffer overflows. The vulnerabilities affect Windows systems utilizing the IKE protocol. The attack complexity for CVE-2026-69429 is high, indicating that exploitation is not straightforward and depends on various factors. As of the publication date, no active exploitation has been reported for these vulnerabilities. Administrators are advised to review the vulnerabilities and apply necessary patches as they become available. 4 sources 40

Extracted Entities

CVE-2026-50696 Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)