The flaw in Windows IKE Extension stems from incorrect handling of untrusted inputs in a security decision. This short‑fall allows an attacker to craft forged IKE packets and inject them into the network, effectively spoofing legitimate IKE traffic. Such spoofing can lead to unauthorized establishment of VPN‑like tunnels, credential compromise, or denial of service against legitimate traffic, thereby undermining confidentiality, integrity, and availability of network communications.

Affected Microsoft products include Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, both standard and server core installations.

The CVSS score of 8.1 signals a high‑risk vulnerability. EPSS is not published, so the likelihood of exploitation cannot be quantified, but the absence from the CISA KEV list does not preclude adoption by threat actors. The attack vector is inferred to be remote over the network, requiring delivery of specially crafted IKE packets that trigger the flawed processing. Because the attack does not depend on privileged local access, any device running a susceptible Windows version could be targeted by an adversary capable of sending network traffic to its IKE services.