CVE-2026-33824: Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability

CVE-2026-33824 is a remote code execution vulnerability in Windows Internet Key Exchange (IKE) Service Extensions, rated Critical by Microsoft, with a CVSS 3.1 base score of 9.8 (Critical). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. CISA added it to the Known Exploited Vulnerabilities catalog on 18 August 2026, with a remediation deadline of 21 August 2026 for US federal agencies. The EPSS model estimates a 77.05% probability of exploitation activity in the next 30 days, higher than 100% of all scored vulnerabilities. Microsoft released the fix on 14 April 2026 in the April 2026 Patch Tuesday, delivered through 9 security updates (KB5082123, KB5082142, KB5082200, KB5082063 and more). It affects 27 products in 2 product families (Windows, ESU).

Key facts

CVE ID

CVE-2026-33824

Severity

Critical CVSS 9.8

Microsoft severity

Critical

Impact

Remote Code Execution

Exploited in the wild

No

Publicly disclosed

No

Exploitation likelihood

Less Likely

Weakness

CWE-415

EPSS

77.05% (percentile 100%)

CISA KEV

Listed 18 August 2026, due 21 August 2026

Released

14 April 2026

Last updated

20 August 2026

Patch Tuesday

April 2026 Patch Tuesday

Product families

Windows, ESU

From the April 2026 Patch Tuesday briefing

Windows IKE Service Extensions Remote Code Execution

CISA KEV deadline: 2026-08-21. This is a remote code execution risk in Windows’ Internet Key Exchange (IKE) components, meaning an attacker could potentially run code on a target system over the network. The practical scenario is exploitation against systems that expose or rely on IKE/IPsec-related services, where a crafted network exchange could lead to system compromise without needing a user to click anything. With a Critical 9.8 score (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CWE-415 Double Free class, this is the month’s most dangerous “reach-and-run” condition: network-reachable, no authentication, no user interaction. In practical terms, any host exposing IKE/IPsec-related services (commonly UDP 500/4500) becomes a candidate for pre-auth remote code execution. Attackers would prioritize this for edge compromise, targeting VPN gateways, perimeter Windows servers, or misconfigured endpoints with exposed IKE, then immediately pivot to credential theft, persistence (service installation/scheduled tasks), and lateral movement.

From the briefing, written by an AI model from PatchaPalooza's data.

CVSS score and vector

Microsoft scores CVE-2026-33824 at 9.8 (temporal 8.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Description

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

Frequently asked questions (Microsoft)

How could an attacker exploit this vulnerability?

An unauthenticated attacker could send specially crafted packets to a Windows machine with Internet Key Exchange (IKE) version 2 enabled, which could enable remote code execution.

Mitigations and workarounds

The following mitigating factors might be helpful in your situation:

Customers who cannot immediately install the security update can take one of the following actions, depending on their environment:

• Block inbound traffic on UDP ports 500 and 4500 for systems that do not use IKE.
• For systems that require IKE, configure firewall rules to allow inbound traffic on UDP ports 500 and 4500 only from known peer addresses.

These actions reduce the attack surface but do not replace installing the security update

Affected products (27)

Windows

ESU

Security updates (9)

• KB5082123 (Security Update)
• KB5082142 (Security Update)
• KB5082200 (Security Update)
• KB5082063 (Security Update)
• KB5083769 (Security Update)
• KB5082052 (Security Update)
• KB5082060 (Security Update)
• KB5083768 (Security Update)
• KB5082198 (Security Update)

Exploitation and detection

CISA Known Exploited Vulnerabilities

Date added

18 August 2026

Federal due date

21 August 2026

Ransomware use

Unknown

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

VulnCheck KEV

Date added

30 July 2026

Ransomware use

Unknown

Independent sources

6

• 30 July 2026 · unit42.paloaltonetworks.com
• 7 August 2026 · recordedfuture.com
• 14 August 2026 · tenable.com
• 18 August 2026 · previdian.com
• 18 August 2026 · cisa.gov
• 20 August 2026 · x.com
• 3 September 2026 · cert.europa.eu
• 8 September 2026 · recordedfuture.com

Detection and weaponization

Weaponization maturity: Exploit.

Proof-of-concept repositories (2)

• kaleth4/CVE-2026-33824 · 2 stars
• EpSiLoNPoInTOrI/IKEV2-POC · 7 stars

NIST NVD data

NVD status

Analyzed

NVD CVSS

9.8 (CRITICAL)

NVD weakness

CWE-415

Published to NVD

14 April 2026

NVD last modified

17 April 2026

Affected configurations (CPE)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824 (Vendor Advisory)

Acknowledgments

• WARP & MORSE team at Microsoft
• WARP & MORSE team at Microsoft

Revision history

Related vulnerabilities

More from the April 2026 Patch Tuesday

• CVE-2026-32202: Windows Shell Spoofing Vulnerability (Medium, CVSS 4.3, exploited)
• CVE-2026-32225: Windows Shell Security Feature Bypass Vulnerability (High, CVSS 8.8)
• CVE-2026-32162: Windows COM Elevation of Privilege Vulnerability (High, CVSS 8.4)
• CVE-2026-33826: Windows Active Directory Remote Code Execution Vulnerability (High, CVSS 8)
• CVE-2026-27909: Windows Search Service Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-27914: Microsoft Management Console Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-32152: Desktop Window Manager Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-32154: Desktop Window Manager Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-27913: Windows BitLocker Security Feature Bypass Vulnerability (High, CVSS 7.7)
• CVE-2026-26151: Remote Desktop Spoofing Vulnerability (High, CVSS 7.1)
• CVE-2026-27908: Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability (High, CVSS 7)
• CVE-2026-27921: Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability (High, CVSS 7)

All vulnerabilities of this release: April 2026 Patch Tuesday · April 2026 briefing

Sources

• Microsoft Security Update Guide: CVE-2026-33824
• NIST NVD: CVE-2026-33824
• CVE.org record: CVE-2026-33824
• CISA KEV catalog: CVE-2026-33824