Unauthenticated RCE via Double Free in Windows IKE Service Extensions (CVE-2026-33824)
CISA added this pre-auth Windows RCE to KEV today with a 2026-08-21 deadline after Unit 42 and Tenable tied it to active attack campaigns, and any internet-facing Windows VPN endpoint left unpatched this week is exposed to unauthenticated remote code execution.
A double free in the Windows IKE (Internet Key Exchange) Service Extensions lets an unauthenticated attacker execute code by sending crafted packets to any Windows machine with IKEv2 enabled — commonly VPN servers and RAS endpoints listening on UDP 500/4500. No credentials or user interaction are required.
Affected: Windows 10 1607/1809/21H2/22H2 below builds 14393.9060 / 17763.8644 / 19044.7184 / 19045.7184; Windows 11 22H3/23H2 below 22631.6936, 24H2 below 26100.8246, 25H2 below 26200.8246, 26H1 below 28000.1836; Windows Server 2016 below 14393.9060
How to Test
Run `winver` or `Get-ComputerInfo OsBuildNumber` and compare against the fixed builds above. Check whether IKE is exposed with `Get-Service IKEEXT` and `netstat -anp UDP | findstr ":500 :4500"`; any system listening on UDP 500/4500 from untrusted networks and below the fixed build is directly exploitable.
How to Patch
Install the April 2026 (or later) Windows security updates that bring systems to the fixed builds listed above. If you cannot patch immediately, block inbound UDP 500 and 4500 on systems that do not use IKE, and restrict inbound UDP 500/4500 to known VPN peer IP addresses on systems that require IKE — per Microsoft this reduces exposure but does not replace the update.