CISA Adds Microsoft Internet Key Exchange RCE Vulnerability Exploited in Attacks

Key Takeaways

• A critical remote code execution vulnerability in Microsoft’s Internet Key Exchange (IKE) Service Extensions, CVE-2026-33824, is actively being exploited.
• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this flaw to its Known Exploited Vulnerabilities catalog.
• The vulnerability is a double-free error (CWE-415) that could lead to memory corruption, allowing attackers to crash services, leak data, or execute arbitrary code.
• A patch is available, and CISA has mandated a rapid remediation deadline for federal agencies.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a urgent warning regarding a critical remote code execution (RCE) vulnerability within Microsoft’s Internet Key Exchange (IKE) Service Extensions. Identified as CVE-2026-33824, this flaw has been added to CISA’s Known Exploited Vulnerabilities catalog, confirming its active exploitation in ongoing attacks.

CISA officially listed the vulnerability on August 18, 2026, imposing a strict remediation deadline of August 21, 2026, for all federal agencies and organizations subject to Binding Operational Directive 26-04. This tight window underscores the severe risk and the high probability that threat actors are aggressively targeting unpatched Microsoft IKE services.

Understanding the Microsoft IKE Vulnerability

CVE-2026-33824 is specifically described as a double-free vulnerability, a memory corruption error (CWE-415) where a program attempts to free the same block of memory twice. Such conditions can be manipulated by attackers to induce service crashes, extract sensitive information, or execute malicious code on affected systems.

The Internet Key Exchange (IKE) protocol is a fundamental component of Internet Protocol Security (IPsec) deployments, crucial for establishing secure VPN connections by negotiating cryptographic keys and security associations. Systems that expose IKE-related services to the internet are particularly vulnerable if this flaw can be exploited remotely and without authentication.

Successful exploitation of an IKE-enabled endpoint could grant attackers a critical foothold, either on a perimeter device or a Windows system facilitating VPN connectivity.

Exploitation and Impact

While CISA currently lists ransomware use for CVE-2026-33824 as undetermined, and Microsoft has not publicly attributed the flaw to any specific ransomware group, remote code execution vulnerabilities in externally accessible network services are highly prized by various malicious actors. These include initial-access brokers, state-sponsored espionage groups, and ransomware affiliates, as they offer a direct entry point without relying on social engineering tactics like phishing or the acquisition of stolen credentials.

CISA has strongly advised organizations to implement vendor-provided mitigations immediately, adhering to Microsoft’s instructions and the directives of BOD 26-04, which mandates prioritized security updates based on risk assessment.

What You Should Do

• Patch Immediately: Identify all assets running Microsoft IKE Service Extensions and apply the relevant security updates as quickly as possible. Prioritize systems exposed to untrusted networks.
• Monitor for Suspicious Activity: Beyond patching, rigorously review perimeter logs, VPN and IPsec telemetry, Windows event logs, endpoint alerts, and network traffic for any anomalies related to IKE services. Investigate unexpected service crashes, repeated malformed connection attempts, unusual processes originating from system services, and suspicious outbound traffic from VPN infrastructure.
• Implement Temporary Mitigations: If immediate patching is not feasible, reduce exposure by restricting IKE traffic to trusted networks, limiting UDP ports 500 and 4500 at perimeter firewalls where operationally viable, and isolating affected hosts from the public internet. These workarounds are temporary and should not replace applying Microsoft’s official fix.
• Evaluate and Discontinue: If effective mitigations cannot be deployed, consider discontinuing the use of the vulnerable product or service until a secure configuration is available.
• Follow Forensics Guidelines: Adhere to applicable forensics triage requirements and thoroughly evaluate each asset’s internet exposure.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.