A critical remote code execution vulnerability in Microsoft Windows Internet Key Exchange (IKE) is now being actively exploited. Tracked as CVE-2026-33824, the vulnerability is a double-free memory corruption issue in the Windows IKE Extension. It carries a CVSS score of 9.8 and can be exploited remotely without authentication or user interaction.
The risk is especially significant for Windows systems exposing IKEv2 over UDP ports 500 or 4500, including VPN gateways, remote-access infrastructure and other hosts using Windows IPsec.
What Is CVE-2026-33824?
CVE-2026-33824 affects Microsoft’s implementation of IKEv2, a protocol used to negotiate security associations and cryptographic keys for IPsec connections.
The underlying weakness exists in ikeext.dll and is caused by incorrect memory ownership during the processing and reassembly of fragmented IKEv2 messages.
The vulnerable code path is reached during IKEv2 fragment reassembly. A pointer associated with Microsoft’s Security Realm functionality is shallow-copied into another packet context. One code path subsequently frees the allocation while the original structure retains a reference to the same memory.
When that original structure is later destroyed, Windows attempts to free the allocation a second time, producing the double-free condition.
Memory corruption vulnerabilities of this type can result in a service crash, but successful exploitation can potentially allow arbitrary code execution.
In the case of CVE-2026-33824, successful code execution occurs within the security context of the Windows IKEEXT service, which runs with SYSTEM privileges.
This makes successful exploitation capable of providing an attacker with control at one of the highest privilege levels available on a Windows system.
How Exploitation Works
Exploitation does not require an attacker to authenticate to the target.
An attacker can trigger the vulnerable condition by sending a specially constructed sequence of IKEv2 packets.
The attack begins with a crafted IKE_SA_INIT message containing Microsoft’s Security Realm Vendor ID.
This is followed by multiple Encrypted Fragment (SKF) payloads forming a fragmented IKE_AUTH message.
During fragment reassembly, Windows mishandles ownership of an internal heap allocation. Subsequent packet cleanup and security association cleanup can then cause the same allocation to be freed twice.
A simplified exploitation sequence is therefore:
Attacker → IKE_SA_INIT → Security Realm Vendor ID → fragmented IKE_AUTH → IKEv2 reassembly → double free → memory corruption → potential SYSTEM-level RCE
Because the vulnerable logic is processed before a legitimate VPN session needs to be established, an attacker does not need valid VPN credentials.
Active Exploitation Confirmed
CVE-2026-33824 was originally patched on April 14, 2026. At the time, Microsoft categorized exploitation as less likely. That assessment is now outdated from a defensive prioritization perspective.
On August 18, CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog. CISA’s vulnerability metadata now explicitly labels exploitation active and indicates that exploitation can be automated.
Affected Systems
The vulnerability affects supported Windows desktop and server releases containing the vulnerable Windows IKE Extension implementation.
NVD lists affected configurations across Windows 10, Windows 11 and Windows Server families, including Windows Server 2016, 2019, 2022 and 2025 branches and multiple supported Windows 10 and Windows 11 releases.
Organizations should not assume that only dedicated VPN servers are vulnerable.
Instead, defenders should identify systems where IKEv2/IPsec functionality is enabled and determine whether UDP/500 or UDP/4500 can be reached from untrusted networks.
Internet-facing Windows systems should receive the highest priority.
Threat Hunting and Detection Opportunities
Unlike many memory corruption vulnerabilities, CVE-2026-33824 has relatively specific network characteristics that defenders can use for detection.
Monitor IKE Traffic on UDP/500 and UDP/4500
Security teams should examine inbound traffic destined for:
UDP/500
UDP/4500
particularly where these services are exposed to the public internet.
Connections from previously unseen or unexpected external addresses, high-volume IKE probing and repeated failed negotiations may warrant investigation.
Correlate IKE_SA_INIT With Fragmented IKE_AUTH
TrendAI’s research indicates that defenders can detect the exploitation sequence by correlating two stages occurring within the same IKE session.
The first stage is an IKE_SA_INIT request containing the Microsoft Security Realm Vendor ID.
The second is a subsequent fragmented IKE_AUTH request using Encrypted Fragment/SKF payloads.
Neither condition is necessarily malicious on its own. The combination occurring sequentially from the same source is substantially more suspicious.
Microsoft Security Realm Vendor ID
Researchers identified the following 16-byte value associated with the Security Realm Vendor ID used in the vulnerable path:
68 6a 8c bd fe 63 4b 40 51 46 fb 2b af 33 e9 e8
Network security devices capable of parsing IKEv2 can look for this value within an IKE_SA_INIT exchange and correlate it with subsequent fragmented IKE_AUTH traffic.
Detect Suspicious Encrypted Fragment Payloads
The vulnerable path uses IKEv2’s Encrypted Fragment payload, identified as payload type 0x35.
Detection logic should therefore pay particular attention to sequences where an IKE_SA_INIT containing the Security Realm Vendor ID is followed by fragmented IKE_AUTH traffic.
For traffic using UDP/4500, defenders should account for the four-byte non-ESP marker prepended to IKE packets when calculating protocol offsets.
Hunt for Post-Exploitation Activity
Because exploitation may provide SYSTEM-level code execution, defenders should also investigate potentially exposed systems for signs of subsequent compromise.
Useful areas to review include:
- unexpected child processes or command execution associated with system services;
- newly created services or scheduled tasks;
- suspicious PowerShell, cmd.exe or scripting activity;
- unexpected outbound connections following inbound IKE traffic;
- reverse-shell or command-and-control activity;
- credential-access activity;
- new administrative users or modified security settings;
- attempts to disable Microsoft Defender or other endpoint controls.
Unit 42 specifically observed attackers attempting reverse-shell callbacks against targeted IKE VPN endpoints, making unexpected outbound network connections following suspicious IKE traffic particularly relevant for hunting.
MITRE ATT&CK Mapping
Observed or directly relevant behavior can be mapped to the following MITRE ATT&CK techniques:
| Tactic | Technique | ID |
| Initial Access | Exploit Public-Facing Application | T1190 |
| Lateral Movement | Exploitation of Remote Services | T1210 |
| Command and Control | Application Layer Protocol / attacker-controlled outbound communications | T1071 |
The exact post-exploitation tradecraft may vary by threat actor, so organizations should avoid relying on a single endpoint behavior to identify compromise.
Recommended Actions
OP Innovate recommends treating CVE-2026-33824 as an emergency patching priority, particularly for Windows systems exposing IKE/IPsec functionality to external networks.
1. Apply Microsoft Security Updates Immediately
Install the applicable Microsoft security updates released in April 2026 or any later cumulative Windows update that supersedes them.
Patching is the only complete remediation for the underlying vulnerability.
Priority should be given to:
- internet-facing Windows VPN gateways;
- Windows servers using IKEv2/IPsec;
- remote-access infrastructure;
- hosts allowing inbound UDP/500 or UDP/4500;
- systems positioned at network boundaries.
2. Block IKE Where It Is Not Required
If a system does not require IKE/IPsec connectivity, block inbound:
UDP/500
UDP/4500
Microsoft and TrendAI both identify restricting these ports as an effective temporary mitigation for systems where IKE is unnecessary.
3. Restrict IKE to Trusted Peers
Where IKE is operationally required, firewall rules should restrict UDP/500 and UDP/4500 traffic to known VPN or IPsec peer addresses wherever architecture permits.
Avoid exposing IKE services broadly to arbitrary internet sources.
4. Hunt for Prior Exploitation
Because the vulnerability has been patched since April but is now confirmed to have been exploited in the wild, organizations should not limit their response to patch deployment.
Review historical firewall, VPN, IDS/IPS and endpoint telemetry for suspicious IKE activity against vulnerable systems, particularly systems that remained unpatched after April 2026.
Pay special attention to suspicious IKE sessions followed by unexpected outbound connections or SYSTEM-level execution.
5. Prioritize Based on Exposure, Not CVSS Alone
Asset owners should identify systems that satisfy all three conditions:
Windows IKEv2 enabled
+
Vulnerable or unverified patch state
+
UDP/500 or UDP/4500 reachable from untrusted networks
These systems should be remediated first.
Stay Safe. Stay Secure.
OP Innovate Research Team
