{"id":"CVE-2026-33824","kind":"vulnerability","aliases":["CVE-2026-33824"],"related":[],"title":"Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network","description":"Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Double free (CWE-415) in the Windows IKEv2 service (IKEEXT), triggered by crafted IKEv2 fragment (SKF) packets sent to UDP 500/4500. Unauthenticated, no user interaction, CVSS 9.8. Patched in April 2026 Patch Tuesday (Apr 14). CISA added it to KEV on Aug 18, 2026. ZDI calls it wormable.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-08-18T00:00:00+00:00","products":[{"name":"Microsoft Internet Key Exchange (IKE) Service Extensions","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows IKE Service Extensions (IKEEXT)","fixed":["10.0.14393.9060","10.0.17763.8644","10.0.19044.7184","10.0.19045.7184","10.0.22631.6936","10.0.26100.8246","10.0.26200.8246","10.0.28000.1836"],"affected":"all supported Windows 10/11/Server builds below the April 2026 update","ecosystem":"vendor"},{"name":"microsoft windows 10 1607","fixed":["10.0.14393.9060"],"affected":"< 10.0.14393.9060","ecosystem":"vendor"},{"name":"microsoft windows 10 1809","fixed":["10.0.17763.8644"],"affected":"< 10.0.17763.8644","ecosystem":"vendor"},{"name":"microsoft windows 10 21h2","fixed":["10.0.19044.7184"],"affected":"< 10.0.19044.7184","ecosystem":"vendor"},{"name":"microsoft windows 10 22h2","fixed":["10.0.19045.7184"],"affected":"< 10.0.19045.7184","ecosystem":"vendor"},{"name":"microsoft windows 11 23h2","fixed":["10.0.22631.6936"],"affected":"< 10.0.22631.6936","ecosystem":"vendor"},{"name":"microsoft windows 11 24h2","fixed":["10.0.26100.8246"],"affected":"< 10.0.26100.8246","ecosystem":"vendor"},{"name":"microsoft windows 11 25h2","fixed":["10.0.26200.8246"],"affected":"< 10.0.26200.8246","ecosystem":"vendor"},{"name":"microsoft windows 11 26h1","fixed":["10.0.28000.1836"],"affected":"< 10.0.28000.1836","ecosystem":"vendor"},{"name":"microsoft windows server 2016","fixed":["10.0.14393.9060"],"affected":"< 10.0.14393.9060","ecosystem":"vendor"},{"name":"microsoft windows server 2019","fixed":["10.0.17763.8644"],"affected":"< 10.0.17763.8644","ecosystem":"vendor"},{"name":"microsoft windows server 2022","fixed":["10.0.20348.5020"],"affected":"< 10.0.20348.5020","ecosystem":"vendor"},{"name":"microsoft windows server 2022 23h2","fixed":["10.0.25398.2274"],"affected":"< 10.0.25398.2274","ecosystem":"vendor"},{"name":"microsoft windows server 2025","fixed":["10.0.26100.32690"],"affected":"< 10.0.26100.32690","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","ikev2","infrastructure","ipsec","microsoft","vpn","windows"],"not_affected_if":["ikev2-disabled","no-ike-exposure","udp-500-4500-blocked"],"how_to_check":"Exposed if the host runs a build below the fixed build and has IKEv2 enabled and UDP 500/4500 reachable (VPN/RRAS server, IPsec policies). Check the build with 'winver' or '[System.Environment]::OSVersion.Version' against the fixed builds. Check the service with 'Get-Service IKEEXT'. Check listeners with 'Get-NetUDPEndpoint -LocalPort 500,4500'.","fix":"Install the April 2026 or later cumulative update. Fixed builds: Win10 1607/Server 2016 10.0.14393.9060; Server 2019 10.0.17763.8644; Win10 21H2/22H2 10.0.19044.7184 and 10.0.19045.7184; Win11 23H2 10.0.22631.6936; Win11 24H2/Server 2025 10.0.26100.8246 (MSRC lists 10.0.26100.32690 for Server 2025); Win11 25H2 10.0.26200.8246; Win11 26H1 10.0.28000.1836. KBs per Rapid7: 24H2 KB5083769, 26H1 KB5083768, Win10 22H2/21H2 KB5082200, 1809 KB5082123, 1607 KB5082198, Server 2022 KB5082142. Workaround: block inbound UDP 500/4500 on systems that do not use IKE; otherwise allow it only from known peer addresses.","status":"open","published_at":"2026-04-14T18:17:34+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:57+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T20:31:57Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2026-33824 per the vendor advisory, as directed by CISA BOD 26-04; if no patch exists, follow the vendor mitigation or discontinue use of the affected service.\nunknown","summary":"Microsoft's IKE Service Extensions component, which handles IPsec key exchange on Windows, has a double free bug that can enable remote code execution. CISA lists it as actively exploited, so an unauthenticated attacker may run code on a vulnerable Windows host reachable over IKE.","category":"infrastructure","who_cares":["windows","ipsec","vpn","microsoft"],"confidence":0.6,"analyst_note":"Find the Microsoft MSRC advisory for CVE-2026-33824 for affected Windows builds, patch KB numbers, and whether exploitation requires network reachability to UDP 500/4500.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-ike-exposure"],"severity_if_unknown":"critical"},"cost_usd":0.000403,"input_tokens":2231,"output_tokens":359,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the Microsoft MSRC advisory for CVE-2026-33824 for affected Windows builds, patch KB numbers, and whether exploitation requires network reachability to UDP 500/4500.","search":"'-04':178C,204C,235C '-2026':18A,21A '-33824':19A,22A '-415':98B '10':37A,41A,45A,49A '11':53A,57A,61A,65A '14':129B '1607':38A '18':137B '1809':42A '2016':70A '2019':74A '2022':78A,82A '2025':87A '2026':125B,138B '21h2':46A '22h2':50A '23h2':54A,83A '24h2':58A '25h2':62A '26':177C,203C,234C '26h1':66A '500/4500':115B '9.8':121B 'accord':167C 'action':163C 'add':131B 'adher':231C 'allow':7A 'appli':164C 'applic':201C 'apr':128B 'april':124B 'asset':225C 'attack':10A 'aug':136B 'base':182C 'bod':176C,202C,233C 'call':140B 'cisa':130B,161C,174C,191C 'cloud':207C 'code':13A,159C 'complianc':172C 'contain':150C 'could':156C 'craft':107B 'cve':17A,20A 'cvss':120B 'cwe':97B 'discontinu':210C 'doubl':1A,95B,152C 'enabl':157C 'ensur':171C,230C 'evalu':223C 'exchang':146C 'exchange':26A 'execut':12A,160C 'exploit':88B 'exposur':228C 'extens':6A,149C 'extensions':29A,33A 'follow':200C 'forens':193C 'fragment':109B 'free':2A,96B,153C 'guidanc':189C,205C 'guidelin':237C 'ike':5A,27A,31A,147C 'ikeext':34A,104B 'ikev2':89B,102B,108B 'infrastructur':90B 'instruct':170C 'interact':119B 'internet':24A,144C,227C 'ipsec':91B 'kev':134B 'key':25A,145C 'microsoft':23A,35A,39A,43A,47A,51A,55A,59A,63A,67A,71A,75A,79A,84A,92B,143C 'mitig':165C,216C 'network':16A 'note':188C,199C 'packet':111B 'patch':122B,126B,236C 'priorit':179C 'product':214C 'remot':158C 'requir':162C,195C 'respons':221C 'risk':184C 'secur':180C 'see':185C,196C 'sent':112B 'server':69A,73A,77A,81A,86A 'servic':103B,148C,208C 'service':28A,32A 'skf':110B 'stakehold':219C 'triag':194C 'trigger':105B 'tuesday':127B 'udp':114B 'unauthent':116B 'unauthor':9A 'unavail':218C 'updat':181C 'url':186C,197C 'use':211C 'user':118B 'vendor':169C 'vpn':93B 'vulner':154C 'window':4A,94B,101B 'windows':30A,36A,40A,44A,48A,52A,56A,60A,64A,68A,72A,76A,80A,85A 'wormabl':142B 'zdi':139B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-04-14T18:17:34+00:00","kev":{"dateAdded":"2026-08-18","dueDate":"2026-08-21","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-33824","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-33824","severity":null,"published_at":"2026-08-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-33824:96","url":null,"severity":null,"published_at":"2026-10-23T21:31:44+00:00","modified_at":"2026-10-23T21:31:44+00:00","first_seen_at":"2026-10-23T21:31:44+00:00","fetched_at":"2026-10-23T21:31:44+00:00","note":"Read the MSRC advisory (affected builds, mitigations), CVE.org, Rapid7 (KBs), ZDI and BleepingComputer. Network reachability of UDP 500/4500 is required, with IKEv2 enabled. MSRC page still shows Exploited: No (it is dated from first publication); KEV and BleepingComputer confirm exploitation. No public PoC found, but ZDI has a technical writeup. I did not search X or Bluesky. The KB list is from Rapid7, not read on MSRC; the Server 2025 build differs between MSRC and CVE.org, so verify it."},{"source":"nvd","external_id":"CVE-2026-33824","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33824","severity":null,"published_at":"2026-04-14T18:17:34+00:00","modified_at":"2026-09-25T18:17:25+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":1064,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824","title":"MSRC CVE-2026-33824","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1065,"url":"https://www.thezdi.com/blog/2026/4/22/cve-2026-33824-remote-code-execution-in-windows-ikev2","title":"ZDI: RCE in Windows IKEv2","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1066,"url":"https://www.bleepingcomputer.com/news/security/cisa-critical-windows-ike-extension-flaw-now-exploited-in-attacks/","title":"BleepingComputer: IKE flaw now exploited","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null},{"id":1067,"url":"https://www.cisa.gov/news-events/alerts/2026/08/18/cisa-adds-four-known-exploited-vulnerabilities-catalog","title":"CISA KEV addition 2026-08-18","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}