CVE-2026-33824: Double free in Windows IKE Extension enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated network-reachable remote code execution, and confirmed exploitation via CISA KEV with a near-immediate remediation deadline.

What it is

A double free flaw (CWE-415) exists in the Windows IKE Extension, reachable over the network by an unauthenticated attacker. Successful exploitation allows arbitrary code execution on the affected Windows host, and the flaw affects a broad set of Windows 10, Windows 11 and Windows Server releases. It is listed in CISA's Known Exploited Vulnerabilities catalog, so it is being exploited in the wild.

Impact

An unauthenticated remote attacker can execute arbitrary code in the context of the IKE service, potentially gaining full control of the host. Given the service context, this can lead to system-level compromise of the affected machine.

Attack surface

Reached over the network via the IKE Extension service; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required. Any internet- or network-exposed host running the affected IKE service is a candidate target.

Exploitation

CISA added this to the KEV catalog on 2026-08-18 with a remediation due date of 2026-08-21, confirming known exploitation. EPSS is 0.727 (99.4th percentile), indicating a high likelihood of exploitation activity in the near term.

What to do

• Apply the Microsoft security update for CVE-2026-33824 to all affected Windows 10, Windows 11 and Windows Server versions as the first action.
• Follow CISA BOD 26-04 guidance and the KEV required action, including forensics triage requirements, for exposed assets.
• Restrict network exposure of IKE/IPsec services (UDP 500/4500) to trusted peers and block them at the perimeter where not required.
• If patching cannot be completed immediately, disable or stop the IKE Extension service on hosts that do not need it.
• Inventory all internet-facing Windows systems and prioritize those with IKE/IPsec endpoints for emergency patching.

Detection

• Monitor for crashes or unexpected restarts of the IKE service (IKEEXT) and related Windows event logs on affected hosts.
• Hunt for anomalous IKE/IPsec negotiation traffic, especially malformed or repeated packets from untrusted external sources to UDP 500/4500.
• Review process creation and network connections originating from the IKE service context for signs of code execution or lateral movement.
• Correlate host telemetry with CISA KEV timelines and check for exploitation attempts against unpatched systems in the weeks around the KEV addition date.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.