The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are exploiting a critical-severity remote code execution (RCE) flaw in the Windows Internet Key Exchange (IKE) Service Extensions component. Also known as MS-IKEE, this is a set of additional capabilities Microsoft added to the IKE Protocol, including authentication via cryptographically generated addresses (CGAs), denial-of-service protection, and easier interoperability with non-Internet Protocol Security (IPsec)–capable peers. Tracked as CVE-2026-33824, this RCE vulnerability impacts all supported Windows 10, Windows 11, and Windows Server releases, and it allows attackers without privileges to gain code execution by sending maliciously crafted packets to unpatched Windows systems through UDP ports 500 or 4500. "Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network," Microsoft says in an advisory issued during the April 2026 Patch Tuesday when it addressed the vulnerability. "An unauthenticated attacker could send specially crafted packets to a Windows machine with Internet Key Exchange (IKE) version 2 enabled, which could enable remote code execution." Microsoft also advised security teams that can't immediately install the CVE-2026-33824 security update to block inbound traffic through UDP ports 500 and 4500 on systems that don't use IKE, or to configure firewall rules to allow inbound traffic only from known peer addresses when IKE is used....
Critical RCE flaw in Windows IKE Extension now actively exploited
Affected Software
Frequently Asked Questions
Which Windows systems are affected by CVE-2026-33824?
The vulnerability affects all supported Windows 10, Windows 11, and Windows Server releases that use the Windows Internet Key Exchange Service Extensions component.
How can an attacker exploit this vulnerability?
An unauthenticated attacker can send specially crafted packets to a Windows machine with IKE version 2 enabled through UDP ports 500 or 4500. Successful exploitation can allow remote code execution on unpatched systems.
Is exploitation of CVE-2026-33824 confirmed?
Yes. CISA warned that hackers are actively exploiting the critical-severity vulnerability, and it was added to the Known Exploited Vulnerabilities catalog on August 20, 2026.
What is the underlying flaw and when was it addressed?
Microsoft described the issue as a double-free vulnerability in the Windows IKE Extension that permits network-based code execution by an unauthorized attacker. Microsoft addressed it during the April 2026 Patch Tuesday.