CVE-2026-33824: Windows IKE Extensions Unauthenticated RCE via Double Free
CVE-2026-33824 (TL-2026-0365), also tracked as GHSA-q6qf-3m2m-xq4f, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-04-15 and last reviewed 2026-08-23. It has no confirmed attribution, affects Microsoft Windows 10, references 1 CVE (CVE-2026-33824), maps to 28 MITRE ATT&CK techniques (T1046, T1053, T1059), and is covered by 9 detection rules and 45 indicators of compromise.
Key facts for TL-2026-0365
- Threat ID
- TL-2026-0365
- Also known as
- GHSA-q6qf-3m2m-xq4f
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-04-15
- Last reviewed
- 2026-08-23
- Attribution confidence
- MEDIUM
- Motivation
- UNKNOWN
- Target sectors
- government, defense, financial, critical-infrastructure, telecommunications, healthcare, energy, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 45
- Updates
- 2026-08-23 · 3 updates · revalidated 3× · latest source
Critical unauthenticated remote code execution vulnerability in Windows Internet Key Exchange (IKE) Service Extensions. A double free condition (CWE-415) in IKEv2 packet processing allows attackers to achieve arbitrary code execution with SYSTEM privileges by sending specially crafted UDP packets to ports 500/4500, requiring no authentication or user interaction. CVSS 9.8.
How CVE-2026-33824 works
CVE-2026-33824 is a critical remote code execution vulnerability in the Windows Internet Key Exchange (IKE) Service Extensions, specifically affecting IKEv2 implementations across all supported Windows versions. The vulnerability was disclosed and patched by Microsoft as part of the April 2026 Patch Tuesday release on April 14, 2026.
The root cause is a double free memory corruption flaw (CWE-415) in the ikeext service component (ikeext.dll) that handles IKEv2 key exchange negotiations for IPSec VPN tunnels. When the IKE service processes specially crafted network packets, it incorrectly attempts to free the same block of heap memory twice. This double free condition corrupts the heap allocator metadata, allowing an attacker to manipulate the state of the memory allocator and achieve arbitrary code execution.
The vulnerability carries maximum exploitability characteristics: it is network-accessible via UDP ports 500 (IKE) and 4500 (IKE NAT-Traversal), requires no authentication (pre-auth), requires no user interaction, and has low attack complexity. The CVSS v3.1 base score is 9.8 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Successful exploitation grants the attacker SYSTEM-level privileges on the target host, as the IKEEXT service runs under the Local System account.
The attack surface is significant because IKE is a fundamental component of IPSec VPN infrastructure. Any Windows system running the IKEEXT service with IKEv2 enabled — including VPN gateways, domain controllers in site-to-site VPN configurations, and servers with IPSec transport mode policies — is potentially exposed. The service listens on UDP ports 500 and 4500, which must be accessible from the network for IPSec to function, making firewall-based mitigation challenging for organizations that depend on IKE/IPSec.
This vulnerability continues a pattern of critical IKE-related flaws in Windows. CVE-2022-34721, patched in September 2022, was a similar IKE Protocol Extensions RCE vulnerability that was addressed by adding length validation checks on incoming data. The IKEEXT service has also been the subject of historical DLL hijacking vulnerabilities affecting Windows Vista through Server 2012, where the service attempted to load non-existent DLLs.
Affected systems span a wide range of Windows versions: Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H2, 23H2, 24H2, 25H2, 26H1), and Windows Server 2016, 2019, 2022, and 2025 across 32-bit, x64, and ARM64 architectures. Microsoft released patches as part of the April 2026 Patch Tuesday update cycle with specific KB articles for each affected version.
As of disclosure, there is no evidence of active exploitation in the wild, no public proof-of-concept code, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Microsoft assesses exploitation as less likely in the latest software releases. However, the pre-authentication, network-accessible nature of the flaw makes it a high-priority patching target, as weaponization could enable wormable exploitation across enterprise networks.
MITRE ATT&CK techniques used in TL-2026-0365
Discovery
T1046 Network Service Discovery; T1518 Software Discovery
Persistence
T1053 Scheduled Task/Job; T1543 Create or Modify System Process
Execution
T1059 Command and Scripting Interpreter; T1059.006 Command and Scripting Interpreter: Python; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Defense Evasion
T1070.004 Indicator Removal: File Deletion; T1211 Exploitation for Stealth; T1562.001 Impair Defenses: Disable or Modify Tools; T1574 Hijack Execution Flow
Command and Control
T1071 Application Layer Protocol; T1090.002 Proxy: External Proxy; T1102.002 Web Service: Bidirectional Communication
Initial Access
T1190 Exploit Public-Facing Application
Lateral Movement
T1210 Exploitation of Remote Services
Impact
T1499 Endpoint Denial of Service; T1499.004 Endpoint Denial of Service: Application or System Exploitation
Resource Development
T1583.006 Acquire Infrastructure: Web Services; T1587 Develop Capabilities; T1588 Obtain Capabilities; T1588.002 Obtain Capabilities: Tool; T1588.005 Obtain Capabilities: Exploits; T1588.006 Obtain Capabilities: Vulnerabilities
Reconnaissance
T1595 Active Scanning; T1595.002 Active Scanning: Vulnerability Scanning; T1596.005 Search Open Technical Databases: Scan Databases
Affected products and versions in CVE-2026-33824
- Microsoft — Windows 10
Vulnerable versions: 1607; 1809; 21H2; 22H2
Fixed in: 1607 with April 2026 CU; 1809 with April 2026 CU; 21H2 with April 2026 CU; 22H2 with April 2026 CU - Microsoft — Windows 11
Vulnerable versions: 22H2; 23H2; 24H2; 25H2; 26H1
Fixed in: 24H2 with KB5082063; 25H2 with KB5083769 - Microsoft — Windows Server 2016
Vulnerable versions: All builds before 10.0.14393.9060
Fixed in: 10.0.14393.9060 - Microsoft — Windows Server 2019
Vulnerable versions: All builds before 10.0.17763.8644
Fixed in: 10.0.17763.8644 (KB5082123) - Microsoft — Windows Server 2022
Vulnerable versions: All builds before 10.0.20348.5020
Fixed in: 10.0.20348.5020 (KB5082142) - Microsoft — Windows Server 2025
Vulnerable versions: All builds before 10.0.26100.32690
Fixed in: 10.0.26100.32690 (KB5082063)
Remediation for CVE-2026-33824
Patches
- KB5082123 — Windows Server 2019 (10.0.17763.8644)
- KB5082142 — Windows Server 2022 (10.0.20348.5020)
- KB5082063 — Windows 11 v24H2 / Windows Server 2025 (10.0.26100.32690)
- KB5083769 — Windows 11 v25H2 (10.0.26200.8246)
- Windows Server 2016 — Build 10.0.14393.9060
Immediate actions
- Apply Microsoft April 2026 Patch Tuesday security updates immediately
- Block inbound UDP traffic on ports 500 and 4500 for systems not requiring IKE
- Restrict IKE UDP ports 500/4500 to known peer addresses only for systems requiring IKE
- Monitor IKEEXT service for unexpected crashes or restarts
- Review Windows Event Logs for anomalous IKE negotiation failures
Workarounds
- Disable IKEEXT service if IPSec/IKE is not operationally required
- Block UDP 500 and 4500 at network perimeter for non-VPN systems
- Limit IKE listener to trusted source IPs via Windows Firewall with Advanced Security
Longer-term hardening
- Implement network segmentation to limit IKE exposure to untrusted networks
- Deploy intrusion detection signatures for malformed IKEv2 packets
- Evaluate transition to modern VPN solutions with smaller attack surface
- Establish automated patch management for critical network protocol vulnerabilities
- Enable Windows Defender Exploit Guard mitigations for heap corruption
CVEs associated with CVE-2026-33824
Weaknesses (CWE) in CVE-2026-33824
CWE-415
Timeline of CVE-2026-33824
Showing the 20 most recent tracked events.
- GitHub Security Advisory GHSA-q6qf-3m2m-xq4f published for CVE-2026-33824 with affected version ranges for all Windows platforms
- CrowdStrike, Tenable, Qualys, Rapid7, and Action1 publish Patch Tuesday analyses highlighting CVE-2026-33824 as critical pre-auth network RCE
- Microsoft publishes MSRC advisory for CVE-2026-33824 with CVSS 9.8 Critical rating, exploitation assessed as less likely in latest releases
- Microsoft releases April 2026 Patch Tuesday addressing 163+ CVEs including CVE-2026-33824 with KB patches for all affected Windows versions
- No active exploitation observed, no public PoC available, vulnerability not added to CISA KEV catalog as of initial assessment
- SANS Internet Storm Center's AtRisk newsletter (Vol. XXVI, No. 15) flags CVE-2026-33824 among the month's notable critical vulnerabilities requiring prompt patching.
- SentinelOne, Action1, and Integrity360 publish independent technical summaries; no known exploitation in the wild but rated highly plausible given the unauthenticated, no-user-interaction vector.
- NVD completes its initial analysis of CVE-2026-33824, confirming the CVSS 3.1 base score of 9.8 and CWE-415 classification.
- The kaleth4/CVE-2026-33824 GitHub repository publishes a documentation-only three-phase exploitation write-up with Snort/Suricata signatures and a PowerShell Windows Event Log monitoring snippet; no functional weaponized exploit code included.
- Zero Day Initiative publishes a root-cause analysis by Richard Chen and Lucas Miller of TrendAI Research, crediting Microsoft's internal WARP & MORSE team with original discovery and documenting the full double-free exploit chain (IkeHandleSecurityRealmVendorId/IkeReinjectReassembledPacket/IkeQueueRecvRequest).
- Unit 42 telemetry captures a documented Hermes Agent autonomous hacking session by the actor 'knaithe'/'KnYuan' as part of the broader campaign that later included manual IKE VPN exploitation.
- As of 2026-05-29, CVE-2026-33824 (Windows IKE double-free RCE) remains patched via April 14 2026 Patch Tuesday with no confirmed in-the-wild exploitation, not in CISA KEV, and no verified public PoC. Some blogs conflate it with the BlueHammer Defender LPE CVE-2026-33825 (the actual KEV-listed zero-day); ZDI/MSRC rate this less likely, crash the probable outcome.
- CISA issues Binding Operational Directive 26-04, establishing a risk-tiered federal patching framework later applied to CVE-2026-33824.
- CISA's Authorized Data Publisher (ADP) enrichment program applies its last modification to the CVE-2026-33824 record as part of ongoing Vulnrichment/SSVC-style exploitability tracking.
- NVD's CVE-2026-33824 record is last modified, reflecting continued analyst tracking roughly two months after disclosure with no confirmed in-the-wild exploitation.
- Palo Alto Networks Unit 42 discloses a Chinese-speaking actor (knaithe/KnYuan, assessed based in Zhuhai, China) running an AI-driven autonomous exploitation campaign (DeepSeek via Hermes Agent, tasked over Telegram, traffic anonymized through a third-party proxy) that included manually driven reverse-shell attempts against three IKE VPN endpoints via CVE-2026-33824.
- CISA adds CVE-2026-33824 to the Known Exploited Vulnerabilities catalog as part of a four-CVE batch addition, confirming active in-the-wild exploitation.
- BleepingComputer, GBHackers, and The Hacker News report on CVE-2026-33824's CISA KEV addition and active exploitation.
- SentinelOne's weekly "Good, the Bad and the Ugly" roundup covers the KEV addition and BOD 26-04 deadline for CVE-2026-33824.
- Under BOD 26-04's highest risk tier, the federal civilian executive branch remediation deadline for CVE-2026-33824 falls three days after KEV addition.
Update history for TL-2026-0365
- 2026-08-23 — Windows IKE Extension Double-Free RCE (CVE-2026-33824) Added to CISA KEV, Actively Exploited: What changed No field escalations — severity (CRITICAL), exploitability (ACTIVE), status (ACTIVE), and CVSS (9.8) already match the existing record from a prior revalidation. The report's LOW attribution-confidence claim is not adopted (wou
- 2026-08-22 — Windows IKE Extension Double-Free RCE (CVE-2026-33824) Actively Exploited, Added to CISA KEV: What changed Exploitability THEORETICAL → ACTIVE; status PATCHED → ACTIVE; attribution_confidence NONE → MEDIUM. CISA added CVE-2026-33824 to its KEV catalog on 2026-08-18 under BOD 26-04 (federal remediation deadline 2026-08-21), and Unit
- 2026-07-19 — CVE-2026-33824: Double-Free Vulnerability in Windows IKEv2 (IKEEXT.DLL) Enables Remote Code Execution: What changed No field escalation: status remains PATCHED, exploitability remains THEORETICAL (no confirmed in-the-wild exploitation or functional public PoC), CVSS unchanged at 9.8. Microsoft's own exploitability index is now cited as 'Expl
Sources cited for CVE-2026-33824
- Microsoft MSRC Advisory — CVE-2026-33824
- CIRCL Vulnerability Lookup — CVE-2026-33824
- CrowdStrike April 2026 Patch Tuesday Analysis
- Tenable — Microsoft April 2026 Patch Tuesday Addresses 163 CVEs
- Qualys — Microsoft and Adobe Patch Tuesday April 2026 Review
- Rapid7 — Patch Tuesday April 2026
- Cybersecurity News — Microsoft Patch Tuesday April 2026
- Action1 — Patch Tuesday April 2026
- GitHub Advisory — GHSA-q6qf-3m2m-xq4f
- Feedly CVE Intelligence — CVE-2026-33824
- WindowsNews — CVE-2026-33824 Demands Immediate Patching
- CSO Online — April Patch Tuesday Zero Days and Critical Bugs
Threats related to CVE-2026-33824
- Microsoft April 2026 Patch Tuesday — 163 CVEs / 88 Advisories (CVE-2026-32201 SharePoint Zero-Day Exploited In-The-Wild, CVE-2026-33825 Defender EoP Public PoC, CVE-2026-33824 IKE RCE CVSS 9.8, CVE-2026-33827 TCP/IP Wormable RCE)
- Microsoft's MDASH AI Scanning Harness Uncovers 16 Windows CVEs, Including Four Critical RCE Flaws in TCP/IP, IKEv2, Netlogon, and DNS
- CVE-2026-23918 — Apache HTTP Server mod_http2 Double Free Enabling Unauthenticated DoS and Possible RCE
- F5 Patches Multiple NGINX Vulnerabilities: Heap Overflow, Memory Disclosure, and Use-After-Free (CVE-2026-42533, CVE-2026-60005, CVE-2026-56434)
Detection coverage for TL-2026-0365
As of 2026-08-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0365 across Splunk SPL, Microsoft KQL and Sigma, covering 45 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.