Windows IKE CVE-2026-33824 exploited: check April's patch

CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog today. The one to look at is CVE-2026-33824 — a CVSS 9.8 unauthenticated remote code execution bug in the Windows Internet Key Exchange service. Microsoft patched it on April 14, 2026. It is being exploited now, four months later, and the federal remediation deadline is August 21. If your April patch cycle slipped, your VPN is the thing that slipped.

What actually happened

The flaw lives in ikeext.dll, the Windows IKEv2 service. Per Zero Day Initiative's analysis, it is a double free during IKEv2 fragment reassembly: a Security Realm blob pointer stays a shallow copy aliasing the original, so the same allocation gets freed twice — once by IkeDestroyPacketContext, again by IkeFreeMMSA. The result is a crash or arbitrary code execution in the context of the IKEEXT service, which runs as SYSTEM.

The attack surface is UDP 500 and 4500. No authentication. That combination is the whole problem: IKE sits at the network perimeter to terminate site-to-site VPNs, remote access VPNs, and Windows Always On VPN, and it processes unauthenticated traffic as a normal part of its job.

Affected builds run from Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025. Microsoft shipped the fix in the April 2026 Patch Tuesday. CISA listed it in KEV on August 18, 2026 with a due date of August 21.

Why an April CVE in KEV matters for your business

KEV inclusion is not new information about the bug. It is new information about you. Nothing changed in the code today; what changed is that someone confirmed attackers are using it, which converts "we'll get to it" into a countdown.

The four-month gap is the story. This was CVSS 9.8, unauthenticated, pre-auth, on a service that by design faces the internet. It was patched in a routine Patch Tuesday. And enough machines are still unpatched in August that exploitation is worth an attacker's time. That is not a technology failure. That's a patch cycle where perimeter devices are somebody else's job.

Three things to do today, in order. Confirm your VPN concentrators and RRAS servers took the April 2026 cumulative update — check the build number, not the WSUS approval status. Then check whether UDP 500 and 4500 are reachable from the open internet on anything you did not intend, because Always On VPN gets stood up on general-purpose Windows Server more often than anyone admits. Then look at whether an IKEEXT crash would even page you. A SYSTEM-context exploit on the box that terminates your tunnels is not a device you want finding out about secondhand.

The BOD 22-01 deadline binds federal agencies. It is not a regulation for you. It is a free, well-researched priority signal, published daily, that tells you which of the 200 CVEs on your dashboard are actually being used against people. Read it that way.

Sources: CISA Known Exploited Vulnerabilities Catalog, Zero Day Initiative: CVE-2026-33824 Remote Code Execution in Windows IKEv2, Microsoft Security Update Guide.