CISA says attackers are exploiting a critical Windows Internet Key Exchange flaw that lets unauthenticated network traffic reach remote code execution. The agency added CVE-2026-33824 to its Known Exploited Vulnerabilities catalog on August 18 and set an August 21 remediation deadline for covered federal systems.
Microsoft fixed the double free on April 14. The newly actionable fact is CISA’s August active-exploitation alert, which moves a four-month-old update into incident-priority territory for any Windows host that still accepts IKEv2 traffic on UDP 500 or 4500.
April fixed the IKE path
Internet Key Exchange establishes the security associations used by IPsec. Microsoft’s CVE-2026-33824 advisory says a double free in the Windows IKE Service Extensions can let an unauthorized attacker execute code over the network. The flaw carries a 9.8 CVSS score and requires neither privileges nor user interaction.
The packet path begins before authentication.
“An unauthenticated attacker could send specially crafted packets to a Windows machine with Internet Key Exchange (IKE) version 2 enabled,” Microsoft wrote. That condition defines the first recognition task: find Windows hosts where IKEv2 is enabled, then identify which of those hosts accept inbound UDP 500 or 4500 from untrusted or unnecessarily broad address ranges.
Microsoft lists 27 affected product and architecture records across supported Windows 10, Windows 11, and Windows Server releases. The public advisory does not describe the packet structure, the reliability of code execution, or a signature that separates exploit traffic from ordinary IKE negotiation.
August changed the threat state
CISA says its four August 18 KEV additions are based on evidence of active exploitation and explicitly names CVE-2026-33824. Its filtered catalog record lists ransomware use as unknown and provides no attacker, victim, geography, campaign, or exploitation-volume details. The sources also do not say whether the observed exploitation produced successful code execution.
The later exploitation record changes priority.
Microsoft’s April advisory still reports “Exploited: No” and rates exploitation less likely. Those positions carry different dates: Microsoft’s record describes its assessment when the update shipped, while CISA’s later listing supplies the current operational signal. Defenders should preserve both facts in incident notes instead of converting the KEV entry into an unsupported claim about victims or widespread compromise.
Microsoft’s response is to install the security update. Where an immediate update is impossible, its advisory says to block inbound UDP 500 and 4500 on systems that do not use IKE. Systems that require IKE should allow those ports only from known peer addresses. Microsoft says these rules reduce the attack surface and do not replace the update.
Exposure depends on IKEv2
The vulnerable path starts with network reachability. A host below its fixed build still needs IKEv2 enabled and a route that admits the crafted packets. Internet exposure deserves immediate attention, but an internal host reachable from a compromised segment or an untrusted peer also remains within the published conditions.
Reachability decides which hosts need immediate containment.
Figure details
The figure has two left-to-right lanes. The published exploit conditions run from crafted IKEv2 traffic on inbound UDP 500 or 4500, through a Windows IKE service that is enabled and reachable, to the CVE-2026-33824 double free and remote code execution. The defender lane runs from scoping hosts by build, IKEv2 state and effective firewall policy, through peer restriction or the April update, to proof of a fixed build or later cumulative update. A final evidence bar says CISA confirms exploitation while the sources identify no actor, victim count or campaign artifacts.
The primary sources publish no payload hash, filename, process tree, command line, domain, IP address, or event identifier. They also do not distinguish a delivered payload from executed attacker code in any observed case. A KEV match establishes exploitation of the vulnerability in the wild; investigation of a specific host still needs local network, process, authentication, and endpoint evidence.
Verify builds and peer rules
Use the April fixed-build floor that matches each release. Microsoft records the following cumulative updates and the updates they superseded:
The running build is the decisive measurement.
| Windows release | April update | Fixed build | Superseded update |
|---|---|---|---|
| Windows 10 1607; Server 2016 | KB5082198 | 10.0.14393.9060 | KB5078938 |
| Windows 10 1809; Server 2019 | KB5082123 | 10.0.17763.8644 | KB5078752 |
| Windows 10 21H2 | KB5082200 | 10.0.19044.7184 | KB5078885 |
| Windows 10 22H2 | KB5082200 | 10.0.19045.7184 | KB5078885 |
| Windows 11 23H2 | KB5082052 | 10.0.22631.6936 | KB5078883 |
| Windows 11 24H2 | KB5083769 | 10.0.26100.8246 | KB5078740 |
| Windows 11 25H2 | KB5083769 | 10.0.26200.8246 | KB5079473 |
| Windows 11 26H1 | KB5083768 | 10.0.28000.1836 | KB5079466 |
| Windows Server 2022 | KB5082142 | 10.0.20348.5020 | KB5078766 |
| Windows Server 2022 23H2 | KB5082060 | 10.0.25398.2274 | KB5078734 |
| Windows Server 2025 | KB5082063 | 10.0.26100.32690 | KB5078740 |
A later cumulative update supersedes the listed April update and also satisfies the version condition. Check the running build on every host with IKEv2 enabled or inbound UDP 500/4500 exposure. Independently inspect the effective firewall policy rather than relying on a change ticket or intended configuration.
The expected result is that every in-scope host reports its applicable fixed build or a later superseding cumulative update. Any temporary exception should show UDP 500 and 4500 blocked, or limited to documented known peers, until the running build proves that the vulnerable IKE path is gone.