Advisory · CVE-2026-33824
Attackers are exploiting a critical Windows IKE remote-code-execution flaw
A critical double-free flaw in the Windows IKE service can allow an unauthenticated network attacker to execute code on a reachable system.
- Vendor
- Microsoft
- Product
- Windows IKE Service Extensions
- Identifier / CWE
- CVE-2026-33824
CWE-415 - Action timing
- Aug 21, 2026
Explain it like I’m five
A specially shaped network message makes Windows discard the same piece of memory twice. That mistake can let the sender replace normal instructions with their own and take control of the system.
- 01IKE traffic
An unauthenticated attacker sends crafted traffic to a reachable Windows IKE service.
- 02Double free
The service releases the same memory allocation more than once.
- 03Memory corrupted
The attacker manipulates the resulting memory state to influence execution.
- 04Code execution
Attacker-selected code can run on the Windows host.
What happened
CISA added CVE-2026-33824 to the Known Exploited Vulnerabilities catalog on August 18, 2026. Microsoft rates the Windows Internet Key Exchange service vulnerability critical at CVSS 9.8. Its network attack vector requires no privileges or user interaction.
The flaw is a double free in the IKE Service Extensions. Crafted network traffic can corrupt memory and lead to remote code execution. Systems exposing IPsec or VPN services deserve immediate attention because the vulnerable component is part of the path intended to establish trusted network connections.
What to do
- Identify Windows systems running or exposing IKE and IPsec services, including VPN gateways and remotely managed infrastructure.
- Apply the Microsoft security update for every affected Windows version.
- Restrict unnecessary inbound IKE traffic while updates are being deployed.
- Preserve and review firewall, VPN, Windows event, endpoint, and crash telemetry for unusual IKE traffic or unexplained service failures.
- Investigate unexpected processes, persistence, account changes, and outbound connections on exposed systems.
- Rotate credentials and certificates available to a system if compromise cannot be excluded.
- Confirm the installed update and retest the intended network exposure after remediation.
Management note
The combination of unauthenticated network reachability, remote code execution, a 9.8 score, and known exploitation removes most prioritization ambiguity. Patch exposed systems and collect evidence before normal log-retention windows erase it.