CISA Says Windows IKE Extension RCE Is Being Exploited
Summary
CISA says attackers are exploiting CVE-2026-33824, an unauthenticated RCE flaw in the Windows IKE Extension. Microsoft has patched it; CISA set a three-day remediation deadline for U.S. federal agencies.
Key points
- CISA added CVE-2026-33824 to its actively exploited vulnerabilities catalog and ordered U.S. federal civilian agencies to remediate it within three days under BOD 26-04.
- The flaw allows unauthenticated remote code execution through crafted packets sent to Windows systems with IKEv2 enabled over UDP ports 500 or 4500.
- All supported Windows 10, Windows 11, and Windows Server releases are affected.
- Microsoft described the issue as a double-free vulnerability and addressed it in its April 2026 Patch Tuesday updates.
- Microsoft advises applying the update; if that is not immediately possible, restrict inbound UDP ports 500 and 4500 where IKE is unused, or allow traffic only from known peers where it is used.
- Microsoft had not updated its advisory to note exploitation, and CISA said it had no further information about attacks.
Article Details
- Vulnerability Types
- Remote code execution
- Double free
- Severity
- Critical
- Affected Versions
- Windows 10 (all supported releases)
- Windows 11 (all supported releases)
- Windows Server (all supported releases)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- On systems that do not use IKE, block inbound traffic on UDP ports 500 and 4500.
- When IKE is used, configure firewall rules to allow inbound traffic only from known peer addresses.
MITRE ATT&CK
CVE
Vendors
Products
Windows 10CISA has warned that attackers are actively exploiting CVE-2026-33824, a critical remote code execution flaw in the Windows IKE Extension that affects supported Windows 10, Windows 11, and Windows Server systems.Windows 11CISA has warned that attackers are actively exploiting CVE-2026-33824, a critical remote code execution flaw in the Windows IKE Extension that affects supported Windows 10, Windows 11, and Windows Server systems.Windows IKE ExtensionCISA has warned that attackers are actively exploiting CVE-2026-33824, a critical remote code execution flaw in the Windows IKE Extension that affects supported Windows 10, Windows 11, and Windows Server systems.Windows ServerCISA has warned that attackers are actively exploiting CVE-2026-33824, a critical remote code execution flaw in the Windows IKE Extension that affects supported Windows 10, Windows 11, and Windows Server systems.