CISA Adds Microsoft IKE Extension Double-Free Bug (CVE-2026-33824) to KEV, Citing Active Exploitation

CISA has added CVE-2026-33824, a double-free vulnerability in Microsoft's Internet Key Exchange (IKE) Service Extensions, to its Known Exploited Vulnerabilities (KEV) catalog as of August 18, 2026. Per Microsoft's advisory, the flaw could enable remote code execution. No CVSS score has been published yet, and CISA's KEV listing indicates confirmed real-world exploitation, though details on the threat actor(s) and scope of attacks have not been disclosed. Ransomware use is currently listed as unknown.

Why It Matters

IKE is used to negotiate and manage IPsec VPN and site-to-site tunnel connections, meaning the affected service typically runs on internet-facing or perimeter-adjacent Windows systems. A remote, unauthenticated (or low-complexity) memory-corruption bug in this component is a high-value target: successful exploitation of a double-free can lead to arbitrary code execution in a privileged network-facing process, potentially giving an attacker an initial foothold or a path to lateral movement inside VPN-connected environments. Because KEV inclusion requires evidence of active exploitation, organizations running Windows systems with IKE/IPsec services exposed should treat this as an immediate priority, not a routine patch-cycle item.

What Defenders Should Do Now

• Identify all Windows hosts running IKE/IPsec services (VPN gateways, RRAS servers, site-to-site tunnel endpoints) and prioritize patching per Microsoft's guidance once available/applied.
• Review firewall and network exposure for IKE-related ports (UDP 500/4500) — restrict exposure to only necessary peers where feasible.
• Monitor for anomalous crashes or restarts of IKE-related services (e.g., IKEEXT service instability), which can be a symptom of failed or successful exploitation attempts against a memory-corruption bug.
• Hunt for unexpected process spawns, privilege escalation, or outbound connections originating from hosts running the IKE Extension service.
• Watch CISA KEV and Microsoft's advisory for updates on affected versions, patches, and any published indicators of compromise.

Developing Intel

This is a same-day KEV addition and details are still emerging — Microsoft has not yet published a CVSS score, and no technical exploitation details or IOCs are publicly available at this time. We will update this post as more information is confirmed. For the authoritative advisory, see Microsoft's MSRC entry for CVE-2026-33824.