Security readout for executives and security teams
Plain-English summary
A flaw in Windows Internet Key Exchange can let an unauthenticated network attacker exhaust memory and disrupt availability. It does not affect confidentiality or integrity, but successful attacks could interrupt systems or services relying on affected Windows hosts.
Executive priority
Treat this as a high-priority availability issue. Accelerate assessment and patching for exposed servers and business-critical systems; handle less-exposed endpoints through expedited routine maintenance. Escalate immediately if monitoring shows unexplained memory exhaustion or service outages.
Technical view
CVE-2026-35424 is a CWE-401 memory-release failure in Windows IKE. The issue is remotely reachable, requires low attack complexity, privileges, or user interaction, and can cause high availability impact. The supplied CVSS 3.1 score is 7.5.
Likely exposure
Exposure includes the listed Windows 10, Windows 11, and Windows Server builds where IKE is network-reachable. Internet-facing or otherwise untrusted-network-reachable hosts warrant faster attention. The bundle does not identify required configuration details, affected ports, or specific deployment scenarios.
Exploitation context
The supplied record does not list this CVE in KEV, and its CVSS exploit-maturity value is unproven. No provided source supports active exploitation. Nevertheless, remote, unauthenticated access and low attack complexity make the availability risk operationally significant.
Researcher notes
The record attributes denial of service to memory not being released after its effective lifetime. Available evidence establishes network reachability and high availability impact, but does not describe triggering conditions, affected IKE states, patch KB numbers, or observable indicators. Avoid assuming remote code execution or data compromise.
Mitigation direction
- Review Microsoft’s advisory for the applicable security update for each affected Windows release.
- Apply vendor-provided updates using the organisation’s established emergency or high-severity patch process.
- Prioritize IKE-reachable servers and systems supporting availability-sensitive services.
- Restrict unnecessary network reachability to IKE while updates are pending.
- Monitor Microsoft guidance for revised affected versions or mitigations.
Validation and detection
- Inventory Windows editions and builds, then compare them with the supplied affected list.
- Determine which affected hosts expose IKE to untrusted or external networks.
- Confirm the applicable Microsoft security update is installed on each affected host.
- Monitor affected systems for unusual memory growth, instability, or service disruption.
- Recheck Microsoft’s advisory after remediation for updated applicability information.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-35424 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C3.93.6microsoftVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Internet Key Exchange (IKE) Protocol Denial of Service VulnerabilityCVE reference, microsoft · vendor-advisory, patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.