CISA Adds Windows IKE Extension Flaw to Known Exploited Vulnerabilities Catalog

CISA added a critical remote code execution vulnerability in the Windows IKE Extension to its Known Exploited Vulnerabilities (KEV) catalog — a "double free" memory corruption issue that threat actors are actively targeting in real-world attacks, not just a theoretical risk.

Why KEV Listing Changes the Urgency Calculus

CISA's KEV catalog specifically lists vulnerabilities with confirmed active exploitation, distinct from the much larger set of disclosed-but-not-yet-exploited CVEs most organizations triage on a normal patch cycle. Federal civilian agencies face binding deadlines to remediate KEV-listed flaws — and even for organizations outside that mandate, KEV listing is one of the most reliable available signals for which patches genuinely can't wait for a normal monthly cycle.

• IKE (Internet Key Exchange) is core VPN and IPsec infrastructure — a flaw here has a direct path to network-level compromise, not just a single application
• "Double free" memory corruption bugs are a well-understood exploitation class with mature tooling available to attackers, which is part of why this specific flaw likely moved from disclosure to active exploitation quickly
• Any organization running Windows systems with IKE/IPsec VPN functionality exposed should treat this as a priority patch, not queue it behind lower-severity items in a normal patch cycle