Critical RCE Flaw in Windows IKE Extension (CVE-2026-33824) Now Actively Exploited

CVE-2026-33824 is a double free (CWE-415) in the Windows Internet Key Exchange Service Extensions, the MS-IKEE extension layer over IKEv2, and an unauthenticated attacker triggers it by sending crafted packets to UDP port 500 or 4500 on any supported Windows 10, Windows 11, or Windows Server host with IKEv2 enabled. Microsoft shipped the fix on April 14, 2026 in the April Patch Tuesday, rated it Critical with a CVSS 3.1 base score of 9.8, and recorded at publication that the bug was not publicly disclosed, showed no exploitation, and carried an Exploitation Less Likely assessment with exploit code maturity marked Unproven. On August 18, 2026 CISA added the CVE to the Known Exploited Vulnerabilities catalog, and the reporting driving this story confirms exploitation in the wild.

The story is the four month gap between patch and proof. The fix has been available through Windows Update since mid April, so every machine now being exploited is one that missed a routine monthly rollup, and its exposure reduces to one question: can untrusted hosts reach UDP 500 or 4500. IKE is the handshake that establishes IPsec security associations, which concentrates the risk on perimeter VPN endpoints, RRAS and routing servers, and any workstation running a client that listens on those ports, and a hit there hands an attacker code execution before credentials ever enter the picture. The April triage, Unproven exploit and Less Likely, is precisely why many shops deprioritized this over flashier April items, and the KEV listing invalidates that triage retroactively. CISA's remediation deadline of August 21, 2026, a three day window under BOD 26-04 with ransomware use marked Unknown, signals the government treats this as a live pre-auth network-facing RCE rather than a routine patch cycle item.

Patch to at least the April 2026 builds: KB5083769 takes Windows 11 24H2 and 25H2 to 26100.8246 and 26200.8246, KB5082052 covers Windows 11 23H2 at 22631.6936, KB5082200 covers Windows 10 21H2 and 22H2 at 19044.7184 and 19045.7184, KB5082123 covers Windows 10 1809 and Server 2019 at 17763.8644, KB5082198 covers Windows 10 1607 and Server 2016 at 14393.9060, KB5082142 and KB5082060 cover Server 2022, and KB5082063 covers Server 2025. Where patching lags, Microsoft's mitigation is to block inbound UDP 500 and 4500 on systems that do not use IKE, and on systems that do, to restrict inbound traffic on those ports to configured peer addresses. The hunt follows the port: enumerate hosts listening on UDP 500 and 4500, flag any below the fixed builds above, then review perimeter firewall and VPN appliance logs for inbound IKEv2 packets from addresses that are not known peers, because successful exploitation would otherwise be indistinguishable from ordinary VPN negotiation and requires no user interaction to land.

Two developments change the assessment. Microsoft revised the advisory on August 20, 2026 to clarify the mitigation wording, an informational change that shows guidance on this bug is still being adjusted, so a further revision or a change in the exploitation assessment warrants attention. The KEV entry also marks ransomware campaign use as Unknown; a flip to Known, or public exploit code appearing for the UDP 500 and 4500 path, would turn patch lag into breach triage for every internet reachable host still answering on those ports.