CVE-2026-33824

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-33824 9.8

Microsoft · Internet Key Exchange (IKE) Service Extensions · Added 2026-08-18 · Published 2026-04-14

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityMicrosoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

VendorMicrosoft

ProductInternet Key Exchange (IKE) Service Extensions

Date added2026-08-18

Due date2026-08-21

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-415

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.

NVD: Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-25 19:47 UTC

Searches2

Component defaultyes

Sources https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824
https://github.com/EpSiLoNPoInTOrI/IKEV2-POC
https://github.com/nomi-sec/PoC-in-GitHub/blob/master/2026/CVE-2026-33824.json
https://www.zerodayinitiative.com/blog/2026/4/22/cve-2026-33824-remote-code-execution-in-windows-ikev2
https://www.vicarius.io/vsociety/posts/cve-2026-33824-mitigation-script-windows-ike-service-extensions-rce
https://cvereports.com/reports/CVE-2026-33824
https://cvefeed.io/vuln/detail/CVE-2026-33824
https://gist.github.com/alon710/72ffbfd3bbf665e2f18362997a746b1f
https://www.penligent.ai/hackinglabs/cve-2026-33824/

Hunting hypothesis agent

Hunt for IKEv2 SKF-fragmented packets with Security Realm Vendor ID on UDP 500/4500, then correlate IKEEXT crashes (ikeext.dll offset 0x12B960 in Event Log) and outbound port 4444 reverse shells.

Research details

ComponentIKEEXT service (ikeext.dll double-free in IKEv2 IKE_SA_INIT payload handling at offset 0x12B960)

PreconditionsUnauthenticated network access to UDP port 500 or 4500 on a Windows host running the IKEEXT service; target must have the IKE Service Extensions enabled (default on Windows 10/11 and Server 2016+ with Always On VPN or IKEv2 configured); no authentication required. agent

DeliveryNetwork (IKEv2 over UDP 500/4500); SKF-fragmented IKE_SA_INIT payloads with Security Realm Vendor ID trigger the double-free in ikeext.dll.

Public PoCyes

PoC URLs https://github.com/EpSiLoNPoInTOrI/IKEV2-POC
https://github.com/nomi-sec/PoC-in-GitHub/blob/master/2026/CVE-2026-33824.json Third-party repos; verify before use.

Advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824

Exploit notesPublic PoC available (IKEV2-POC repo, C/C++) but explicitly not fully functional per author. Prototype exploit targeting double-free in ikeext.dll at offset 0x12B960; demonstrates the attack chain: IKEv2 SKF-fragmented packets on UDP 500 trigger the double-free, followed by heap grooming (4 threads, 0x1000-byte chunks, 1000 iterations), ROP chain construction from ikeext.dll gadgets, and reverse shell on port 4444. The exploit sends IKE_SA_INIT payloads with AES-CBC-128 / HMAC-SHA2-256 / DH MODP-2048 transforms. PoC is a research prototype with heavy obfuscation, anti-debug, and partial GUI — not a ready-to-use weapon. CVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0).

SummaryMicrosoft IKE Service Extensions (IKEEXT) contains a double-free vulnerability (CWE-415) in ikeext.dll's IKE_SA_INIT payload handling at offset 0x12B960, enabling unauthenticated remote code execution over IKEv2 on UDP 500/4500. An attacker sends SKF-fragmented IKEv2 packets to trigger the double-free, then uses heap grooming (4 threads, 0x1000-byte chunks) and ROP chain construction from ikeext.dll gadgets for code execution, with a reverse shell on port 4444. A public PoC (IKEV2-POC, C/C++) demonstrates the attack chain but is not fully functional per the author; it uses AES-CBC-128 / HMAC-SHA2-256 / DH MODP-2048 transforms. CVSS 9.8 CRITICAL; patched in April 2026 Patch Tuesday; affects Windows 10 1607+, Windows 11, and Server 2016+.

Tia coverage

First reported2026-07-22

First exploit report2026-08-19

Exploit report → KEV1 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

critical-rce-flaw-in-windows-ike-extension-now-actively-exploite microsoft-exchange-2016-2019-security-updates-end-in-october

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.