CVE-2022-21889

Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability

High7.5EPSS 3.2%

Published: 11 Jan 2022
Updated: 2 Jan 2025
Reserved: 14 Dec 2021
Assigned by: microsoft

Description

Timeline

2021
14 Dec 2021
14 Dec 2021
ID reserved
By microsoft
2022
11 Jan 202228 days later
11 Jan 2022· 28 days later
Published
2025
2 Jan 20253 years later
2 Jan 2025· 3 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2022-21889, by who scored it
Scored by	CVSS	Score	Vector
microsoftCNA (assigner)	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
NVDNVD · Modified	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (exploitation in 30 days): 3.2% · top 12% of all CVEs (7 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

Denial of Service

Affected products

Microsoft · Windows 10 Version 1809
- affected 10.0.17763.0 – < 10.0.17763.2452
Microsoft · Windows 10 Version 1809
- affected 10.0.0 – < 10.0.17763.2452
Microsoft · Windows Server 2019
- affected 10.0.17763.0 – < 10.0.17763.2452
Microsoft · Windows Server 2019 (Server Core installation)
- affected 10.0.17763.0 – < 10.0.17763.2452
Microsoft · Windows 10 Version 1909
- affected 10.0.0 – < 10.0.18363.2037
Microsoft · Windows 10 Version 21H1
- affected 10.0.0 – < 10.0.19043.1466
Microsoft · Windows Server 2022
- affected 10.0.20348.0 – < 10.0.20348.469
Microsoft · Windows 10 Version 20H2
- affected 10.0.0 – < 10.0.19042.1466
Microsoft · Windows Server version 20H2
- affected 10.0.0 – < 10.0.19042.1466
Microsoft · Windows 11 version 21H2
- affected 10.0.0 – < 10.0.22000.434
Microsoft · Windows 10 Version 21H2
- affected 10.0.19043.0 – < 10.0.19044.1466
Microsoft · Windows 10 Version 1507
- affected 10.0.10240.0 – < 10.0.10240.19177
Microsoft · Windows 10 Version 1607
- affected 10.0.14393.0 – < 10.0.14393.4886
Microsoft · Windows Server 2016
- affected 10.0.14393.0 – < 10.0.14393.4886
Microsoft · Windows Server 2016 (Server Core installation)
- affected 10.0.14393.0 – < 10.0.14393.4886
Microsoft · Windows 7
- affected 6.1.0 – < 6.1.7601.25829
Microsoft · Windows 7 Service Pack 1
- affected 6.1.0 – < 6.1.7601.25829
Microsoft · Windows 8.1
- affected 6.3.0 – < 6.3.9600.20246
Microsoft · Windows Server 2008 R2 Service Pack 1
- affected 6.1.7601.0 – < 6.1.7601.25829
Microsoft · Windows Server 2008 R2 Service Pack 1 (Server Core installation)
- affected 6.1.7601.0 – < 6.1.7601.25829
Microsoft · Windows Server 2012
- affected 6.2.9200.0 – < 6.2.9200.23584
Microsoft · Windows Server 2012 (Server Core installation)
- affected 6.2.9200.0 – < 6.2.9200.23584
Microsoft · Windows Server 2012 R2
- affected 6.3.9600.0 – < 6.3.9600.20246
Microsoft · Windows Server 2012 R2 (Server Core installation)
- affected 6.3.9600.0 – < 6.3.9600.20246

References (2)

Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability (opens in a new tab)vendor-advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21889 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-21889](https://trackcve.app/badge/CVE-2022-21889.svg)](https://trackcve.app/cve/CVE-2022-21889)

Record last updated 2 Jan 2025, 18:22 UTC.