CVE-2026-122169 · Infrastructure
NO FIX YET
The Windows IKE Extension, which handles IPsec key exchange, has an access control check that is too coarse. An authorized local attacker can perform spoofing on the machine.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Affects Windows systems running the IKE Extension, which is used for IPsec and VPN key exchange. The attacker must already hold a local authorized account on the machine. Sources do not say which Windows builds are affected or whether default configurations are exposed.
Not affected if non-windows-systems
Who cares ipsec, vpn, windows
winver against the Microsoft update history for CVE-2026-122169No fix yet, per the sources.
Insufficient granularity of access control in Windows IKE Extension allows an authorized attacker to perform spoofing locally.
This page as .md · .json · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.