The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned of the active exploitation of a critical vulnerability that enables remote code execution in the Windows Internet Key Exchange (IKE) Service Extensions component. The vulnerability is tracked as CVE-2026-33824 and affects all supported versions of Windows 10, Windows 11, and Windows Server.
The vulnerability allows an unauthorized attacker to execute code on an unpatched system by sending malicious network packets to a device running version 2 of the IKE protocol. The attack does not require an account or prior privileges, as it can be exploited through UDP ports 500 or 4500, the two ports typically used for IKE communications.
What is the nature of the flaw?
Microsoft attributes the vulnerability to a Double Free bug in the Windows IKE extension. According to the company’s advisory issued as part of the April 2026 Patch Tuesday updates, an unauthenticated attacker can send specially crafted packets to a device using IKE version 2, potentially resulting in remote code execution.
MS-IKEE represents a set of additional capabilities that Microsoft added to the IKE protocol, including authentication using cryptographically generated addresses, protection against denial-of-service attacks, and improved interoperability with parties that do not support the Internet Protocol Security (IPsec) protocol.
CISA action and the specified deadline
CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog and ordered U.S. federal civilian executive-branch agencies to secure their devices within three days, based on Binding Operational Directive BOD 26-04. The agency said that this type of vulnerability represents a recurring attack vector and could pose significant risks to the federal environment.
The binding directive does not directly apply to organizations outside the U.S. government, but CISA urged all network defense administrators to prioritize updating CVE-2026-33824 to prevent ongoing attacks. Microsoft has not yet updated its advisory to indicate active exploitation, nor has it provided additional details about the attacks when asked by BleepingComputer.
What changes in practice for security teams?
The priority is to install the security update that addressed the vulnerability. If that cannot be done immediately, Microsoft recommends blocking incoming traffic over UDP 500 and UDP 4500 on systems that do not use IKE. For systems that rely on it, incoming connections can be restricted through firewall rules that allow them only from the addresses of known peers.
The warning comes as part of a series of CISA alerts concerning Microsoft vulnerabilities exploited in the wild. Since November 2021, the agency has listed 385 exploited vulnerabilities in Microsoft products, 112 of which were also used by ransomware groups. It recently confirmed the exploitation of a vulnerability in Windows Task Host in ransomware attacks and warned about the use of a remote code execution vulnerability in Microsoft SharePoint during attacks whose initial signs of exploitation began appearing in early July.