If IPv6 is the future, why would I turn it off?

Risks do not arise because organizations consciously choose IPv6. On the contrary. Microsoft enables IPv6 by default on Windows systems and, moreover, gives it priority over IPv4. However, many organizations still use only IPv4. This creates a situation in which a protocol that no one actively uses still affects network traffic. And that is precisely where attackers can exploit the vulnerability.

Many organizations have built their networks, firewall rules, monitoring, and logging entirely around IPv4. That’s not surprising. IPv4 has been the standard for years, and many administrators know this protocol inside and out.

Meanwhile, IPv6 is often enabled by default on workstations and servers—even without organizations having consciously chosen to do so. Because Windows gives priority to IPv6 over IPv4, traffic can be routed via IPv6, even if an organization believes it is using only IPv4.

An attacker can exploit this default setting by redirecting IPv6 traffic to their own system. The organization expects all traffic to go through IPv4, while Windows makes a different choice. As a result, network traffic can be intercepted or rerouted without existing security measures immediately detecting it. So the problem is not IPv6 itself. The problem is that it is active, takes precedence, and often goes unnoticed.

IPv6 was developed as the successor to IPv4. The main reason for this is that the number of available IPv4 addresses is limited. With 128-bit addresses, IPv6 offers a virtually unlimited number of unique IP addresses. In addition, the protocol enables more efficient routing and supports modern network features. That makes IPv6 undeniably the future.

But just like any new technology, it requires a different approach to management. For years, many security measures and network designs have been based on IPv4. With IPv6, some things work differently.

A well-known example is the elimination of NAT (Network Address Translation). With IPv4, multiple devices often share a single public IP address. In practice, this creates an additional layer between internal systems and the internet. With IPv6, each device has its own unique address. This means that security depends entirely on a properly configured firewall and correct access rules. When you use IPv6, your network management, monitoring, and security policies must therefore be configured accordingly.

This example shows how a Microsoft default setting can directly impact your organization’s security. IPv6 is enabled by default and takes precedence over IPv4. This happens even if your organization does not yet use IPv6 at all. Without you even realizing it, this can create an additional attack vector. It is therefore important to regularly check which default settings are active on your workstations and servers, and whether they still align with the way your organization operates.

Are you actively using IPv6? If so, make sure your network architecture, firewall configuration, monitoring, and security policies are fully optimized for IPv6. If you’re not using IPv6 yet, it’s wise to disable it. This will prevent a protocol you’re not using from being exploited.

It is precisely these kinds of default settings that we regularly encounter during a Microsoft 365 Security Review. By periodically checking your environment, you can avoid surprises and ensure that your security measures align with the way your organization actually operates.