---
title: "Windows IKE CVE-2026-33824: Exploited Pre-Auth RCE"
url: https://erroneo.us/security/briefs/windows-ike-cve-2026-33824-pre-auth-rce/
description: "Critical double free in Windows IKEv2, patched Apr 14, 2026, added to KEV in August. Check that no unpatched host exposes UDP 500/4500."
type: security-brief
section: "Security Digest"
date_published: 2026-04-14
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-33824"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Windows IKE CVE-2026-33824: Exploited Pre-Auth RCE

**Verdict: Check exposure.** The fix shipped in April, so most fleets are already covered; the real risk is any unpatched Windows host that answers IKE on UDP 500 or 4500 from untrusted networks, and those need patching or blocking today.

- **Who must act:** Owners of Windows hosts that act as IKEv2 responders (RRAS or IKEv2 VPN servers, Windows IPsec gateways) or otherwise accept UDP 500/4500 from the internet or untrusted networks, if they lack the April 2026 or later update.
- **Who can relax:** Fleets on the April 14, 2026 or any later cumulative update, and hosts where UDP 500/4500 is not reachable from untrusted networks, need only confirm that.
- **Affected:** Windows 11 24H2 / 25H2 before builds 26100.8246 / 26200.8246; Windows 11 23H2 before build 22631.6936; Windows 11 26H1 before 28000.1836; Windows 10 1607 / 1809 / 21H2 / 22H2 before builds 14393.9060 / 17763.8644 / 19044.7184 / 19045.7184; Windows Server 2016 / 2019 / 2022 before builds 14393.9060 / 17763.8644 / 20348.5020; Windows Server 2022 23H2 (Server Core) before 25398.2274; Windows Server 2025 before 26100.32690
- **Fixed:** KB5083769 (Windows 11 24H2 and 25H2), KB5082052 (23H2), KB5083768 (26H1); KB5082200 (Windows 10 21H2 and 22H2); KB5082198 (Windows 10 1607 / Server 2016), KB5082123 (Windows 10 1809 / Server 2019); KB5082142 (Server 2022), KB5082060 (Server 2022 23H2), KB5082063 (Server 2025); Any later cumulative update
- **CVEs:** CVE-2026-33824
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find every Windows host that accepts UDP 500 or 4500 from the internet or untrusted networks, starting with RRAS, IKEv2 VPN and IPsec gateway servers.
2. Confirm those hosts run the April 14, 2026 update or later; patch any that do not today.
3. Block inbound UDP 500 and 4500 at the perimeter and host firewall wherever IKE is not used.
4. Where IKE is needed, allow UDP 500/4500 only from known peer addresses until patched.
5. Treat an internet-exposed IKE host that stayed unpatched into August 2026 as possibly compromised and review it.

### How to check if you are affected

- List local listeners with Get-NetUDPEndpoint -LocalPort 500,4500, and scan public IPs from outside with nmap -sU -p 500,4500.
- Check the build (CurrentBuild and UBR in HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion) against the fixed builds.
- Look for unexpected terminations of the IKEEXT (IKE and AuthIP IPsec Keying Modules) service in the System log, since a failed attempt can crash it.
- Review exposed IKE hosts for unusual outbound connections, new accounts, services or scheduled tasks, consistent with the reverse-shell attempts Unit 42 reported.

## What happened

Microsoft fixed [CVE-2026-33824](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824) on April 14, 2026, more than four months before CISA listed it. It is a double free (CWE-415) in the Windows Internet Key Exchange (IKE) Service Extensions, the IPsec keying service that runs as IKEEXT. Microsoft says "an unauthenticated attacker could send specially crafted packets to a Windows machine with Internet Key Exchange (IKE) version 2 enabled," which could lead to remote code execution. It rates the bug Critical, CVSS 3.1 9.8. Microsoft's WARP and MORSE team found it internally.

The [Zero Day Initiative write-up](https://thezdi.com/blog/2026/4/22/cve-2026-33824-remote-code-execution-in-windows-ikev2) by TrendAI Research traces the bug to `ikeext.dll`. It describes "improper ownership handling of a heap-allocated blob pointer during IKEv2 fragment reassembly." The trigger is an IKE_SA_INIT message followed by encrypted fragments carrying an invalid IKE_AUTH, all before authentication. The result is a crash of the IKEEXT service or possibly code execution as SYSTEM.

At release Microsoft called exploitation "less likely." On July 30, [Unit 42](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/) reported a Chinese-speaking actor using the aliases knaithe and KnYuan. Besides AI-driven scanning, the actor ran manual attacks that included "reverse shell callbacks targeting three IKE VPN endpoints." Unit 42 lists the result as "Active exploitation, reverse shell attempts." It does not say the attempts worked. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33824) on August 18, with a federal deadline of August 21. CISA's enrichment of the CVE record cites the Unit 42 report. CISA itself has not said who it saw exploiting the bug.

## Who is affected

The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-33824) lists Windows 10 1607 through 22H2, Windows 11 23H2 through 26H1, and Windows Server 2016, 2019, 2022 and 2025 before the April builds. Examples are 19045.7184 for Windows 10 22H2, 26100.8246 for Windows 11 24H2 and 20348.5020 for Server 2022. Server 2012 and 2012 R2 do not appear in the record. ZDI notes that all supported Windows versions include the IKE extensions for VPN support. The ports that matter are UDP 500 and 4500. [Gridinsoft's analysis](https://blog.gridinsoft.com/cve-2026-33824-windows-ike-vpn-exploit/) names the urgent cases as internet-reachable IKE responders: RRAS, IKEv2 VPN servers and Windows IPsec gateways.

## Do you really need to act?

Check, then act on what you find. Pre-authentication RCE over the network is the worst kind of bug, and someone is trying to use it. But the fix is six months old, and any April or later cumulative update covers it. The exposed population is narrow: Windows hosts that are unpatched and also answer IKE from networks you do not trust. Find those hosts.

One discrepancy to note: as of October 21, 2026, Microsoft's advisory still says "Exploited: No." Its August 20 revision only clarified the mitigation text. [BleepingComputer](https://bleepingcomputer.com/news/security/cisa-critical-windows-ike-extension-flaw-now-exploited-in-attacks/) reported that Microsoft told customers who applied the update that they "are protected and do not need to take further action." Go by CISA's listing, not Microsoft's flag.

## What to do now

1. Find listeners on each host with `Get-NetUDPEndpoint -LocalPort 500,4500`. From outside, run `nmap -sU -p 500,4500 <public-ip>` against your public ranges and cloud instances.
2. Check the build with `Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR`. Install the April 2026 update (for example KB5083769, KB5082200, KB5082142) or any later cumulative update.
3. Where IKE is not used, block it. Microsoft's mitigation is to block inbound UDP 500 and 4500, for example `New-NetFirewallRule -DisplayName "Block IKE" -Direction Inbound -Protocol UDP -LocalPort 500,4500 -Action Block`, plus the same rule at the perimeter.
4. Where IKE is needed, allow UDP 500/4500 only from known peer addresses until patching is done. Microsoft stresses that these steps "do not replace installing the security update."

## How to tell if you were hit

No IKE-specific hashes or indicators have been published. On exposed hosts that were unpatched, look for unexpected terminations of the IKEEXT service (IKE and AuthIP IPsec Keying Modules) in the System log. Look also for unusual outbound connections from the server, and for new accounts, services, scheduled tasks or remote-management tools. ZDI gives a network signature: an IKE_SA_INIT carrying Microsoft's Security Realm Vendor ID, followed by encrypted-fragment packets with an invalid IKE_AUTH from the same source. If an internet-facing IKE host stayed unpatched into August, investigate it. Do not just patch it and move on.

## Timeline

- Apr 14, 2026 — Microsoft fixes the bug on Patch Tuesday, rated Critical and "Exploitation Less Likely."
- Apr 23, 2026 — ZDI publishes the root cause and detection guidance.
- Jul 30, 2026 — Unit 42 reports reverse-shell attempts against three IKE VPN endpoints.
- Aug 18, 2026 — CISA adds the CVE to KEV. The federal deadline is August 21.
- Aug 20, 2026 — Microsoft revises the mitigation text. The advisory still says "Exploited: No."

## Sources

1. [Microsoft MSRC — CVE-2026-33824 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824)
2. [Microsoft MSRC — April 2026 Security Updates (CVRF data with KB numbers and acknowledgments)](https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Apr)
3. [CVE record — CVE-2026-33824](https://www.cve.org/CVERecord?id=CVE-2026-33824)
4. [NVD — CVE-2026-33824](https://nvd.nist.gov/vuln/detail/CVE-2026-33824)
5. [CISA — Known Exploited Vulnerabilities: CVE-2026-33824](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33824)
6. [Palo Alto Networks Unit 42 — Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/)
7. [Zero Day Initiative (TrendAI Research) — CVE-2026-33824: Remote Code Execution in Windows IKEv2](https://thezdi.com/blog/2026/4/22/cve-2026-33824-remote-code-execution-in-windows-ikev2)
8. [Gridinsoft — CVE-2026-33824 Exploited Against Windows IKE VPNs](https://blog.gridinsoft.com/cve-2026-33824-windows-ike-vpn-exploit/)
9. [BleepingComputer — Critical RCE flaw in Windows IKE Extension now actively exploited](https://bleepingcomputer.com/news/security/cisa-critical-windows-ike-extension-flaw-now-exploited-in-attacks/)

---
Source page: https://erroneo.us/security/briefs/windows-ike-cve-2026-33824-pre-auth-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt