CRITICAL: Windows IKE Flaw CVE-2026-33824 Under Active Exploitation

There is a particular flavor of dread that comes from reading a CISA advisory and realizing the patch has been sitting in your update console since April.

On August 18, CISA added four vulnerabilities to the Known Exploited Vulnerabilities catalog. The SharePoint and vCenter entries collected most of the attention, but the one that should be reorganizing your week is CVE-2026-33824, a double free in the Windows Internet Key Exchange Service Extensions. It carries a CVSS 3.1 base score of 9.8, and it hands an unauthenticated attacker arbitrary code execution as SYSTEM on any Windows machine that answers IKE traffic. Microsoft shipped the fix back in the April 2026 cumulative updates. Attackers, it turns out, read patch notes too. Federal civilian agencies have until August 21 to remediate under Binding Operational Directive 22-01, which for everyone else translates roughly to "this should already be done."

Drop everything and patch this one. That is not hyperbole about a theoretical bug in an obscure component. This is the service that terminates your VPN.

Why a VPN Service Is the Worst Possible Place for This

The IKEEXT service is what negotiates IPsec security associations on Windows. If you run Routing and Remote Access, Always On VPN, Windows terminated site to site tunnels, or DirectAccess leftovers that nobody has decommissioned, IKEEXT is listening on UDP 500 and UDP 4500. That is not a misconfiguration. That is the entire point of the service, and it means the vulnerable code path is deliberately exposed to the open internet on the exact devices that sit at your network edge.

Worse, IKEEXT runs inside a svchost process with SYSTEM privileges. There is no sandbox, no user context to escape, and no authentication step standing between a hostile packet and full control of the host. An attacker who lands here does not need a privilege escalation chain. They arrive already holding the keys, on a machine that by definition has routes into everything the VPN was built to reach.

The Technical Shape of the Bug

The root cause is a pointer ownership mistake during IKEv2 fragment reassembly, and it is the kind of thing that reads as obvious in hindsight and stays invisible in review. Zero Day Initiative published the teardown in April, and the mechanics are worth understanding because they explain why the attack is so cheap to launch.

When the function IkeReinjectReassembledPacket() handles a reassembled fragmented IKE_AUTH message, it copies a block of main mode security association fields into a stack structure. Sitting inside that block at offset 0x208 is a pointer to a heap allocated Security Realm blob. The copy is shallow rather than deep, so when the structure gets passed along to IkeQueueRecvRequest(), two entirely separate code paths end up holding the same heap pointer and both believe they own it. Cleanup then does what cleanup does. IkeDestroyPacketContext() releases the blob through WfpMemFree(), and later IkeFreeMMSA() frees the identical allocation a second time. That is CWE-415 in its purest textbook form, and on modern Windows heaps a controlled double free is a well trodden road to controlled code execution.

Triggering it requires no credentials and no user interaction. An attacker sends an IKE_SA_INIT message carrying the Microsoft Security Realm Vendor ID, then follows it with two or more encrypted fragment payloads containing a deliberately invalid IKE_AUTH message. The reassembly logic does the rest. The CVSS vector reflects exactly how few obstacles stand in the way, reading AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which is the scoring equivalent of a shrug and an open door. Network reachable, low complexity, no privileges required, no interaction needed, and total loss of confidentiality, integrity, and availability at the end of it.

Who Is Exposed

The blast radius covers roughly sixteen Microsoft products. Every supported Windows 10 build from 1607 through 22H2 is affected, along with Windows 11 from 22H2 through 26H1, and the full Windows Server line from 2016 through 2025. Public exploit code circulating on GitHub and the usual aggregator sites claims reliable execution across that entire patch table, which removes the last comfortable excuse that this is a hard bug to weaponize.

Exploitation is no longer speculative. Palo Alto Networks Unit 42 observed a Chinese speaking actor manually driving reverse shell callbacks from three separate IKE VPN endpoints through this vulnerability, and it was that telemetry, along with corroborating reporting, that pushed CISA to add the CVE to the catalog. The word "manually" is the detail worth pausing on. This was hands on keyboard operator activity against selected VPN concentrators, not opportunistic spray across the internet. That pattern usually points toward initial access brokering or espionage staging rather than smash and grab ransomware, and it means the targets were chosen for what sits behind them.

The uncomfortable arithmetic is that the patch has been available since April while confirmed exploitation surfaced in August. Anyone still unpatched has had a four month window in which a critical, network reachable bug with public exploit code was sitting on their edge devices waiting to be found. Ransomware use is currently listed as unknown, which is a status that historically has a very short shelf life once working exploit code goes public.

What To Do About It

Install the April 2026 cumulative security updates, and do it on the internet facing VPN servers first rather than working alphabetically through your asset list. The relevant packages include KB5082052 for Windows 11 23H2, KB5082200 for Windows 10 22H2, and KB5082063 for Windows Server 2025, with equivalent rollups covering the remaining builds. Because these updates are cumulative, any later monthly rollup applied since April also carries the fix, so the practical task is verifying build numbers rather than hunting down individual KB articles.

If you have a machine that genuinely cannot be patched this week, restrict inbound UDP 500 and UDP 4500 at the firewall to an allow list of known peer addresses. That works well for site to site tunnels with fixed endpoints and works poorly for remote access VPN serving roaming users, which is precisely the deployment most likely to be exposed in the first place. On servers and workstations with no documented IPsec or VPN requirement, disable the IKEEXT service outright. A surprising number of general purpose Windows servers have that service running for no reason anyone can articulate, and turning it off costs nothing.

For detection, start with the network. Look for IKE_SA_INIT messages carrying the Microsoft Security Realm Vendor ID followed closely by fragmented IKE_AUTH payloads from the same source, because that sequence is the exploit signature and is not something a legitimate client produces. Malformed IKE traffic and unexpected external connection attempts to ports 500 and 4500 belong on your perimeter alerting. On the host side, watch for IKEEXT service crashes and svchost restarts, since unreliable exploitation attempts tend to leave a trail of service terminations before a successful one lands. Any child process spawned from the svchost instance hosting IKEEXT should be treated as an incident until proven otherwise, and outbound connections originating from a VPN server toward unfamiliar infrastructure deserve exactly the same reaction.

One caution worth stating plainly. Patching closes the door, it does not evict anyone who already walked through it. Given a four month exposure window and confirmed hands on keyboard activity, any internet facing Windows VPN endpoint that ran unpatched into August deserves a compromise assessment rather than a reboot and a shrug. Check those hosts for new local accounts, unfamiliar scheduled tasks, freshly installed services, and modifications to certificate stores.

The MSP Angle

Every client running a Windows terminated VPN is a phone call worth making today, and "we noticed you were exposed to an actively exploited flaw and we have already patched it" remains the single most effective renewal conversation in this business. The follow on sells itself, because this incident is a clean argument for external attack surface monitoring as a recurring service, the kind that would have flagged an unpatched IKE endpoint in April instead of producing an emergency in August. Package the compromise assessment on affected VPN hosts as a fixed fee engagement now, and use the four month patch gap as your exhibit for why managed patching with verified build reporting beats the honor system.