Windows IKE Extension CVE-2026-83521

Exploitation targets the Windows IKE (Internet Key Exchange / IPsec) Extension, so the affected host must have IKE/IPsec processing reachable by the attacker - typically systems running IPsec, IKEv2 VPN, or Windows Firewall with Advanced Security connection-security rules. Per the CVSS vector, the attacker must be authorized (PR:L), meaning some level of authenticated or trusted access is required rather than fully anonymous access; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The impact is limited to confidentiality (information disclosure of process memory) with no integrity or availability effect, which bounds realistic risk. Limiting factors: the required privilege level and the need for the IKE Extension to be exposed/enabled to the attacker's network path.

This is a moderate-severity information-disclosure flaw that signals should be read as 'patch on normal cycle,' not 'emergency.' The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) indicates a low-complexity network-reachable attack but one that requires existing privileges (PR:L), with only confidentiality impact (C:H) and no integrity or availability effect. CISA's SSVC decision supports a low-urgency posture: Exploitation=none (no observed exploitation), Automatable=no, and Technical Impact=partial. There is no CISA KEV listing and no public POC in the provided data, so active or widespread exploitation is not indicated. EPSS is not provided, so exploitation probability cannot be quantified here. The signals are consistent rather than conflicting: a real but bounded issue affecting an enormously deployed platform (Windows), where the authentication requirement (PR:L) and lack of integrity/availability impact materially cap real-world risk. Note one tension to verify: the CVSS confidentiality rating is High (C:H) while CISA's Technical Impact is only 'partial,' suggesting the memory disclosure, though rated high-confidentiality, may expose limited or non-deterministic data.

An attacker who already holds low-level authenticated access reachable to the target sends specially crafted IKE (IPsec key-exchange) traffic to the Windows IKE Extension, triggering an out-of-bounds read that returns adjacent process memory in the response or error path. The leaked memory could contain sensitive material such as cryptographic key fragments, tokens, or other process data useful for follow-on attacks. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means a working exploit, if developed, would be reliable to trigger.