CVE-2026-33824
Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
Description
CVE-2026-33824 is a critical double free vulnerability in the Windows Internet Key Exchange (IKE) Service Extensions that allows an unauthenticated, remote attacker to execute arbitrary code over a network. The flaw affects a broad range of Microsoft Windows client and server releases, from Windows 10 and Windows Server 2016 through Windows 11 and Windows Server 2025. Because exploitation requires no privileges and no user interaction, an attacker who can reach the IKE service can potentially take full control of the affected host. With a CVSS score of 9.8 and inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog, CVE-2026-33824 represents an urgent patching priority for any organization running Windows systems that expose IKE/IPsec services.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1607 | < 10.0.14393.9060 |
| microsoft | windows 10 1809 | < 10.0.17763.8644 |
| microsoft | windows 10 21h2 | < 10.0.19044.7184 |
| microsoft | windows 10 22h2 | < 10.0.19045.7184 |
| microsoft | windows 11 23h2 | < 10.0.22631.6936 |
| microsoft | windows 11 24h2 | < 10.0.26100.8246 |
| microsoft | windows 11 25h2 | < 10.0.26200.8246 |
| microsoft | windows 11 26h1 | < 10.0.28000.1836 |
| microsoft | windows server 2016 | < 10.0.14393.9060 |
| microsoft | windows server 2019 | < 10.0.17763.8644 |
| microsoft | windows server 2022 | < 10.0.20348.5020 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.2274 |
| microsoft | windows server 2025 | < 10.0.26100.32690 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824(Vendor Advisory)
- https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33824(US Government Resource)
Weakness Type
CWE-415: Double Free
A double free occurs when a program calls free() on the same memory address twice, corrupting the memory allocator's internal data structures and potentially enabling arbitrary code execution. In CVE-2026-33824 this weakness manifests in the Windows IKE Service Extensions, where a memory region tied to the processing of key-exchange traffic is released more than once, allowing an attacker to corrupt heap metadata and hijack execution flow.
Learn more: CWE-415 — Double Free
Impact Analysis
The impact of CVE-2026-33824 is severe: because the attack vector is network-based, the vulnerability is remotely exploitable without any physical access, and with attack complexity low it is easy to trigger without special conditions. Privileges required is none and user interaction is none, meaning an attacker needs no authentication and no help from a victim to launch the attack. A successful exploit results in high impact to confidentiality, integrity, and availability, giving the attacker the ability to read sensitive data, tamper with the system, and disrupt operations — in effect, full compromise of the targeted Windows host. Rated CVSS 9.8 (Critical) and carrying an EPSS score of roughly 78% (99th percentile), CVE-2026-33824 has a high likelihood of active exploitation, which is consistent with its addition to the CISA KEV catalog.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-33824 by adding it to the Known Exploited Vulnerabilities catalog, so organizations should treat this as an in-the-wild threat requiring immediate action. The EPSS score of approximately 78% (99th percentile) indicates a very high probability of exploitation activity, reinforcing the urgency of patching. While the KEV ransomware flag is currently "Unknown," the combination of an unauthenticated, network-reachable code-execution flaw and its near-top EPSS ranking makes it an attractive target for a wide range of attackers. No dedicated public exploit link is listed among the references, but given the confirmed exploitation status, defenders should assume working exploit techniques exist and prioritize remediation accordingly.
Remediation
- Apply the Microsoft security update immediately. Per CISA's KEV required action, apply mitigations in accordance with vendor instructions and adhere to BOD 26-04 patching guidance; if mitigations are unavailable, discontinue use of the affected product.
- Install the fixed build for your specific Windows version. Update to at least the patched builds listed by Microsoft, for example Windows 11 24H2 build 10.0.26100.8246, Windows Server 2025 build 10.0.26100.32690, Windows Server 2022 build 10.0.20348.5020, or the corresponding patched build for Windows 10 and Server 2016/2019.
- Restrict network exposure of the IKE/IPsec service. Until patching is complete, limit access to UDP ports used by IKE (typically 500/4500) through firewall rules and network segmentation so that only trusted peers can reach the service.
- Monitor for exploitation indicators. Review IKE/IPsec and system logs for unexpected service crashes or reloads, which may indicate double free exploitation attempts, and watch for anomalous inbound key-exchange traffic.
- Harden memory-safety exposure long term by prioritizing timely patching of network-facing OS components and reducing the internet exposure of VPN and IPsec endpoints.
Technical Details
CVE-2026-33824 stems from a double free (CWE-415) in the Windows IKE Service Extensions: when memory is freed, the allocator returns it to a free list, and freeing the same address a second time corrupts that list. Subsequent allocations may then hand the same memory to different parts of the program or allow an attacker to manipulate heap metadata to gain code execution. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H shows the flaw is reachable over the network with low complexity and no authentication or user interaction, which is why an unauthenticated remote attacker can trigger the faulty free path simply by sending crafted key-exchange traffic to the exposed IKE service. Because the corruption occurs within a core Windows networking component, successful heap grooming can escalate the condition from a service crash into full arbitrary code execution with system-level impact.
Frequently Asked Questions
Is CVE-2026-33824 being actively exploited?
Yes. CISA has added CVE-2026-33824 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Its EPSS score of about 78% (99th percentile) further indicates a very high likelihood of ongoing exploitation activity.
What products are affected by CVE-2026-33824?
The vulnerability affects the Windows IKE Service Extensions across a wide range of Microsoft Windows releases, including Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016, 2019, 2022, 2022 23H2, and 2025. Each edition is fixed in a specific patched build published by Microsoft.
How do I fix CVE-2026-33824?
Apply Microsoft's security update for your Windows version to reach the fixed build, and follow CISA's KEV guidance under BOD 26-04. Until patched, restrict access to the IKE/IPsec service via firewall rules and network segmentation, and monitor for unexpected service crashes.
How severe is CVE-2026-33824?
It is Critical, with a CVSS 3.1 base score of 9.8. The vulnerability is unauthenticated, network-exploitable, and requires no user interaction while causing high confidentiality, integrity, and availability impact, and its EPSS score sits in the 99th percentile — making it one of the highest-priority vulnerabilities to remediate.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.