CISA has placed CVE-2026-33824 in its Known Exploited Vulnerabilities catalogue after confirming that the flaw in Microsoft's Internet Key Exchange Service Extensions is being used in the wild. The vulnerability carries a CVSS score of 9.8 and permits unauthenticated remote code execution. A patch is already available from Microsoft. Organisations running affected Windows editions should treat the issue as urgent.
The flaw is a double free memory corruption bug in the IKE service extensions component. An attacker who can send specially crafted packets to a vulnerable system can trigger the double free condition, which leads to arbitrary code execution with the privileges of the IKE service. The vulnerability is tracked as CVE-2026-33824 and scores 9.8 on the CVSS v3 scale. Technical details are available in Microsoft's advisory here.
Microsoft identifies the affected products as Windows Server 2019, Windows Server 2022 and certain editions of Windows 10 and Windows 11 that have the IKE Service Extensions feature enabled. The company has released a security update that addresses the double free error and recommends immediate installation. Systems that do not require IKE for VPN or IPsec communications may consider disabling the service until patched.
CISA's decision to add the bug to the KEV catalogue indicates that active exploitation has been observed, although no specific threat actor has been publicly linked to the attacks. The catalogue entry notes that the flaw allows remote code execution via unauthenticated network packets, matching the technical description from the vendor. Inclusion in KEV obliges federal agencies to apply the patch within the timeframe set by Binding Operational Directive 22 01, and it signals to the private sector that the issue is being exploited in the wild.
Defence teams should start by verifying which assets have the IKE Service Extensions feature running and confirming patch status. Where possible, apply the Microsoft update without delay, using existing patch management pipelines or manual deployment for critical servers. For systems that cannot be patched immediately, block inbound UDP port 500 and port 4500 at the perimeter to prevent unwanted IKE traffic, and enable detailed logging of IKE daemon activity to spot anomalous behaviour.
Additionally, review intrusion detection signatures for known exploit attempts targeting the IKE double free and update them if necessary. Share any indicators of compromise with internal threat intelligence feeds and consider reaching out to CISA or Microsoft for further guidance. Maintaining an up to date asset inventory and network segmentation will reduce the attack surface while the patch is rolled out across the estate.