Windows IKE CVE-2026-33824: Exploited Pre-Auth RCE

What to do

1. Find every Windows host that accepts UDP 500 or 4500 from the internet or untrusted networks, starting with RRAS, IKEv2 VPN and IPsec gateway servers.
2. Confirm those hosts run the April 14, 2026 update or later; patch any that do not today.
3. Block inbound UDP 500 and 4500 at the perimeter and host firewall wherever IKE is not used.
4. Where IKE is needed, allow UDP 500/4500 only from known peer addresses until patched.
5. Treat an internet-exposed IKE host that stayed unpatched into August 2026 as possibly compromised and review it.

How to check if you are affected or compromised

• List local listeners with Get-NetUDPEndpoint -LocalPort 500,4500, and scan public IPs from outside with nmap -sU -p 500,4500.
• Check the build (CurrentBuild and UBR in HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion) against the fixed builds.
• Look for unexpected terminations of the IKEEXT (IKE and AuthIP IPsec Keying Modules) service in the System log, since a failed attempt can crash it.
• Review exposed IKE hosts for unusual outbound connections, new accounts, services or scheduled tasks, consistent with the reverse-shell attempts Unit 42 reported.

What happened#

Microsoft fixed CVE-2026-33824 on April 14, 2026, more than four months before CISA listed it. It is a double free (CWE-415) in the Windows Internet Key Exchange (IKE) Service Extensions, the IPsec keying service that runs as IKEEXT. Microsoft says "an unauthenticated attacker could send specially crafted packets to a Windows machine with Internet Key Exchange (IKE) version 2 enabled," which could lead to remote code execution. It rates the bug Critical, CVSS 3.1 9.8. Microsoft's WARP and MORSE team found it internally.

The Zero Day Initiative write-up by TrendAI Research traces the bug to ikeext.dll. It describes "improper ownership handling of a heap-allocated blob pointer during IKEv2 fragment reassembly." The trigger is an IKE_SA_INIT message followed by encrypted fragments carrying an invalid IKE_AUTH, all before authentication. The result is a crash of the IKEEXT service or possibly code execution as SYSTEM.

At release Microsoft called exploitation "less likely." On July 30, Unit 42 reported a Chinese-speaking actor using the aliases knaithe and KnYuan. Besides AI-driven scanning, the actor ran manual attacks that included "reverse shell callbacks targeting three IKE VPN endpoints." Unit 42 lists the result as "Active exploitation, reverse shell attempts." It does not say the attempts worked. CISA added the CVE to the KEV catalog on August 18, with a federal deadline of August 21. CISA's enrichment of the CVE record cites the Unit 42 report. CISA itself has not said who it saw exploiting the bug.

Who is affected#

The CVE record lists Windows 10 1607 through 22H2, Windows 11 23H2 through 26H1, and Windows Server 2016, 2019, 2022 and 2025 before the April builds. Examples are 19045.7184 for Windows 10 22H2, 26100.8246 for Windows 11 24H2 and 20348.5020 for Server 2022. Server 2012 and 2012 R2 do not appear in the record. ZDI notes that all supported Windows versions include the IKE extensions for VPN support. The ports that matter are UDP 500 and 4500. Gridinsoft's analysis names the urgent cases as internet-reachable IKE responders: RRAS, IKEv2 VPN servers and Windows IPsec gateways.

Do you really need to act?#

Check, then act on what you find. Pre-authentication RCE over the network is the worst kind of bug, and someone is trying to use it. But the fix is six months old, and any April or later cumulative update covers it. The exposed population is narrow: Windows hosts that are unpatched and also answer IKE from networks you do not trust. Find those hosts.

One discrepancy to note: as of October 21, 2026, Microsoft's advisory still says "Exploited: No." Its August 20 revision only clarified the mitigation text. BleepingComputer reported that Microsoft told customers who applied the update that they "are protected and do not need to take further action." Go by CISA's listing, not Microsoft's flag.

What to do now#

1. Find listeners on each host with Get-NetUDPEndpoint -LocalPort 500,4500. From outside, run nmap -sU -p 500,4500 <public-ip> against your public ranges and cloud instances.
2. Check the build with Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR. Install the April 2026 update (for example KB5083769, KB5082200, KB5082142) or any later cumulative update.
3. Where IKE is not used, block it. Microsoft's mitigation is to block inbound UDP 500 and 4500, for example New-NetFirewallRule -DisplayName "Block IKE" -Direction Inbound -Protocol UDP -LocalPort 500,4500 -Action Block, plus the same rule at the perimeter.
4. Where IKE is needed, allow UDP 500/4500 only from known peer addresses until patching is done. Microsoft stresses that these steps "do not replace installing the security update."

How to tell if you were hit#

No IKE-specific hashes or indicators have been published. On exposed hosts that were unpatched, look for unexpected terminations of the IKEEXT service (IKE and AuthIP IPsec Keying Modules) in the System log. Look also for unusual outbound connections from the server, and for new accounts, services, scheduled tasks or remote-management tools. ZDI gives a network signature: an IKE_SA_INIT carrying Microsoft's Security Realm Vendor ID, followed by encrypted-fragment packets with an invalid IKE_AUTH from the same source. If an internet-facing IKE host stayed unpatched into August, investigate it. Do not just patch it and move on.

Timeline#

• Apr 14, 2026 — Microsoft fixes the bug on Patch Tuesday, rated Critical and "Exploitation Less Likely."
• Apr 23, 2026 — ZDI publishes the root cause and detection guidance.
• Jul 30, 2026 — Unit 42 reports reverse-shell attempts against three IKE VPN endpoints.
• Aug 18, 2026 — CISA adds the CVE to KEV. The federal deadline is August 21.
• Aug 20, 2026 — Microsoft revises the mitigation text. The advisory still says "Exploited: No."

Vulnerability records

• CVE-2026-33824 · KEV 2026-08-18 · Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft MSRC — CVE-2026-33824 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability msrc.microsoft.com
2. Microsoft MSRC — April 2026 Security Updates (CVRF data with KB numbers and acknowledgments) api.msrc.microsoft.com
3. CVE record — CVE-2026-33824 cve.org
4. NVD — CVE-2026-33824 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2026-33824 cisa.gov
6. Palo Alto Networks Unit 42 — Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks unit42.paloaltonetworks.com
7. Zero Day Initiative (TrendAI Research) — CVE-2026-33824: Remote Code Execution in Windows IKEv2 thezdi.com
8. Gridinsoft — CVE-2026-33824 Exploited Against Windows IKE VPNs blog.gridinsoft.com

Coverage and analysis

1. BleepingComputer — Critical RCE flaw in Windows IKE Extension now actively exploited bleepingcomputer.com