The January 2022 security updates for Microsoft Windows include several important updates that will affect Always On VPN deployments. Specifically, CVE-2022-21849 addresses a Remote Code Execution (RCE) vulnerability that should be addressed immediately. The January 2022 security update also includes updates for several IKE Denial-of-Service (DoS) vulnerabilities, in addition to privilege escalation vulnerabilities in the Remote Access Connection Manager.

Update – January 17, 2022: Microsoft has released out-of-band updates to address the issues with IPsec (IKEv2 and L2TP) when using non-Microsoft VPN devices. Updates can be found here.

• Windows 11 21H2 – KB5010795
• Windows 10 20H2, 21H1, 21H2 – KB5010793 

Update – January 13, 2022: There have been numerous reports of this update breaking VPN functionality when using non-Microsoft VPN devices. If you are using Windows Server and RRAS you can safely update. If you are using a third-party device, you may encounter problems. In addition, there have been reports of issues with domain controllers and Hyper-V servers after installing this update. Please proceed carefully and be sure to have a backup before updating!

Vulnerable Systems

These vulnerabilities are present on both Windows Server and Client operating systems. Essentially, any Windows server or client using IPsec is vulnerable and potentially exploitable.

Vulnerabilities

The following is a list of security updates related to Always On VPN deployments.

Windows IKE Extension Remote Code Execution (RCE) Vulnerability

• CVE-2022-21849

Windows IKE Extension Denial of Service Vulnerabilities

• CVE-2022-21843
• CVE-2022-21848
• CVE-2022-21890
• CVE-2022-21883
• CVE-2022-21889

Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

• CVE-2022-21914
• CVE-2022-21885

Additional Information

A list of all fixes in the January 2022 security update, along with links to the updates themselves, can be found here.