CVE-2026-33824

What it actually does

CVE-2026-33824 is a network-reachable memory corruption vulnerability in the Windows IKE Extension / IKE and AuthIP IPsec Keying Modules component. A double-free condition can be triggered during IKE/IPsec negotiation processing, allowing an unauthenticated remote attacker to corrupt process memory and potentially execute arbitrary code. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, successful exploitation could provide code execution without credentials or user interaction. The vulnerable component is commonly exposed where Windows systems accept IPsec, VPN, or IKE traffic over UDP/500 and UDP/4500.

Why it matters to the business

Successful exploitation could allow an external attacker to compromise Windows workstations or servers that expose IKE/IPsec services, potentially leading to malware deployment, credential theft, lateral movement, service disruption, and full system takeover. The issue affects many supported Windows desktop and server releases, including Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025, so exposure can be broad in organizations using IPsec, VPN gateways, DirectAccess-like configurations, or host-based IPsec policies. Although it is not currently listed in CISA KEV and no mature public exploit is indicated, the high CVSS score and elevated EPSS probability warrant urgent remediation, especially for internet-facing or perimeter-adjacent systems.

How an attack unfolds

An attacker identifies a Windows host that accepts IKE/IPsec negotiation traffic, typically on UDP/500 for IKE or UDP/4500 for NAT traversal. The attacker sends specially crafted IKE negotiation packets that exercise the vulnerable parsing or state-management path in the Windows IKE Extension. The malformed exchange causes the service to free the same memory more than once, corrupting the heap. With reliable exploitation, the attacker shapes memory corruption to gain control of execution inside the affected service process and runs arbitrary code, likely with high local privileges associated with the Windows service context. Failed attempts may cause IKEEXT or its hosting svchost.exe process to crash, producing service-control, application-error, and Windows Error Reporting artifacts. After code execution, an attacker would typically deploy a payload, establish persistence, collect credentials, and pivot to other systems.

How to fix it

Apply the Microsoft security update that fixes CVE-2026-33824 to all affected Windows versions, including Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. No exact fixed build numbers were provided in the input, so use Microsoft Update, WSUS, Intune, Configuration Manager, or the Microsoft Update Catalog to deploy the latest cumulative update released after the vulnerability publication date. Prioritize systems that are internet-facing, VPN-related, domain infrastructure, remote-access infrastructure, or configured for IPsec. Where immediate patching is not possible, restrict UDP/500 and UDP/4500 to trusted peers only, block unsolicited inbound IKE/IPsec traffic at perimeter and host firewalls, disable IKE/IPsec services only where not required, and segment affected systems from untrusted networks. Monitor for IKEEXT crashes until patching is complete.

How to confirm the fix worked

Confirm the relevant cumulative update is installed on each affected Windows endpoint or server using enterprise patch inventory, Windows Update history, Get-HotFix, DISM package inventory, or vulnerability scanning authenticated to the host. Validate that systems no longer report the vulnerability in authenticated scans. For systems that must expose IKE/IPsec, verify that UDP/500 and UDP/4500 are reachable only from approved peers and are blocked from untrusted networks. Review service health after patching to ensure the IKE and AuthIP IPsec Keying Modules service is running normally where required. If compensating controls are used, validate firewall rules with network scans from untrusted network locations and confirm no unintended internet exposure remains.

Typical attack path

1. Scan for Windows hosts exposing IKE/IPsec services on UDP/500 and UDP/4500.
2. Confirm the target responds to IKE or IPsec negotiation attempts.
3. Send crafted IKE/IPsec negotiation traffic designed to trigger the double-free condition in the Windows IKE Extension.
4. Exploit heap corruption to execute attacker-controlled code in the affected service process, or cause a crash during failed attempts.
5. Deploy a post-exploitation payload or command channel.
6. Escalate operational control by collecting credentials, disabling defenses, persisting, and moving laterally.

How to detect it

To determine whether exploitation may have already occurred, review Windows System, Application, Security, Windows Error Reporting, and IKE/IPsec operational logs for crashes or restarts involving IKEEXT, ikeext.dll, or svchost.exe around times of inbound UDP/500 or UDP/4500 traffic. Look for Service Control Manager events indicating the IKE and AuthIP IPsec Keying Modules service terminated unexpectedly, Application Error events showing svchost.exe faulting in ikeext.dll, Windows Error Reporting crash buckets for IKEEXT-related faults, and repeated IKE negotiation failures from the same external source. Correlate these events with firewall, VPN, EDR, NetFlow, packet-capture, and perimeter logs showing malformed or high-volume IKE traffic. Also hunt for post-exploitation indicators after any suspicious crash, including new services, scheduled tasks, unusual child processes or network connections from svchost.exe, credential-dumping activity, unexpected administrative logons, and newly created persistence mechanisms. Because exploitation of memory corruption may leave limited application-level evidence, prioritize correlation between service instability, inbound IKE traffic, and subsequent suspicious host behavior.

• UDP/500
• UDP/4500
• IKEEXT
• ikeext.dll
• C:\Windows\System32\ikeext.dll
• Microsoft-Windows-IKE/Operational
• The IKE and AuthIP IPsec Keying Modules service terminated unexpectedly
• Faulting application name: svchost.exe
• Faulting module name: ikeext.dll
• Application Error Event ID 1000
• Windows Error Reporting Event ID 1001
• Service Control Manager Event ID 7031
• svchost.exe -k netsvcs
• IKE and AuthIP IPsec Keying Modules

What your security team should do

• Prioritize patching internet-facing or VPN/IPsec-enabled Windows servers and workstations first, followed by internal systems that accept IPsec traffic.
• Inventory exposure to UDP/500 and UDP/4500 across perimeter, cloud, remote-access, and internal network segments.
• Deploy the latest applicable Windows cumulative updates through standard patch management and verify installation with authenticated scanning.
• Temporarily restrict IKE/IPsec traffic to known trusted peers where patching cannot be completed immediately.
• Hunt for recent IKEEXT or svchost.exe crashes, especially where they correlate with inbound UDP/500 or UDP/4500 traffic from untrusted sources.
• Increase logging and alerting for abnormal IKE negotiation failures, repeated service restarts, and unexpected outbound connections from svchost.exe.
• Treat unexplained IKEEXT crashes on exposed systems as potentially suspicious until reviewed, even though no mature exploit is currently reported.
• Review VPN/IPsec configurations and remove unnecessary exposure of IKE services.