CISA Confirms Active Exploitation of Critical Windows IKE Flaw CVE-2026-33824
Hackers have begun exploiting a critical Windows vulnerability that allows remote code execution on a target computer without requiring an account or any user interaction whatsoever. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed real-world attacks and directed federal agencies to install the corresponding patches.
CVE-2026-33824: A Critical Double-Free Flaw in Windows IKE
The vulnerability, tracked as CVE-2026-33824 and rated 10.0 Critical, affects supported versions of Windows 10, Windows 11, and Windows Server. Microsoft addressed the flaw back in April 2026. The underlying issue resides in the Internet Key Exchange (IKE) protocol extensions, which Windows relies on when establishing secure network connections.
The vulnerability stems from a double-free memory error. Exploiting it requires no credentials and no prior access to the target system whatsoever – an attacker need only send specially crafted network packets to a computer with IKEv2 enabled. As a result, the attacker can achieve remote code execution on the affected machine.
How IKE Operates and Why It’s Exposed
IKE protocol data travels over UDP ports 500 and 4500. Microsoft’s extensions to the IKE protocol add a range of capabilities, including denial-of-service protection, support for operating through network address translation, authentication using cryptographically generated addresses, and compatibility with nodes lacking IPsec support.
Added to CISA’s Known Exploited Vulnerabilities Catalog
On August 18, CISA added CVE-2026-33824 to its catalog of vulnerabilities already being exploited by attackers. The agency has not yet disclosed details regarding the attacks themselves, the identity of targeted organizations, or the specific tools involved. As of publication, Microsoft’s own advisory had also not been updated to reflect confirmed active exploitation.
Remediation Deadline and Recommended Mitigations
U.S. federal civilian agencies have been directed to remediate the vulnerability within three days. CISA also recommends that all organizations install the April security update as quickly as possible. For systems where immediate patching isn’t feasible, Microsoft advises blocking inbound traffic on UDP ports 500 and 4500 on any system where IKE is not needed. Where the service is actively in use, firewalls should be configured to accept connections only from known, trusted hosts.
Why This Vulnerability Poses Elevated Risk
Several factors compound the danger posed by CVE-2026-33824: the attack travels entirely over the network, requires no authentication, and is already being exploited in the wild. Windows systems reachable through the affected UDP ports that have not yet received the April patch should be updated without delay.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
