Search threats, CVEs… ⌘K
Back to vendor advisories
Microsoft Security Response CenterCVE-2026-33824

Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

Read the vendor bulletin Get alerts for Windows
9.8CVSS out of 10Critical severity
Scope

What the vendor says is affected

  • Windows 10 Version 1809 for 32-bit Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows Server 2019
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2022
  • Windows Server 2022 (Server Core installation)
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 10 Version 22H2 for x64-based Systems
  • Windows 10 Version 22H2 for ARM64-based Systems
  • Windows 10 Version 22H2 for 32-bit Systems
  • Windows Server 2025 (Server Core installation)
  • Windows 11 Version 25H2 for ARM64-based Systems
  • Windows 11 Version 25H2 for x64-based Systems
  • Windows 11 Version 23H2 for ARM64-based Systems
  • Windows 11 Version 23H2 for x64-based Systems
  • Windows Server 2022, 23H2 Edition (Server Core installation)
  • Windows 11 Version 24H2 for ARM64-based Systems
  • Windows 11 Version 24H2 for x64-based Systems
  • Windows Server 2025
  • Windows 11 version 26H1 for x64-based Systems
  • Windows 11 Version 26H1 for ARM64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems

Versions the vendor lists as fixed

  • 10.0.17763.8644
  • 10.0.20348.5020
  • 10.0.19044.7184
  • 10.0.19045.7184
  • 10.0.26100.32690
  • 10.0.26200.8246
  • 10.0.22631.6936
  • 10.0.25398.2274
  • 10.0.26100.8246
  • 10.0.28000.1836
  • 10.0.14393.9060
Next step

What the vendor recommends

The following mitigating factors might be helpful in your situation: Customers who cannot immediately install the security update can take one of the following actions, depending on their environment: Block inbound traffic on UDP ports 500 and 4500 for systems that do not use IKE. For systems that require IKE, configure firewall rules to allow inbound traffic on UDP ports 500 and 4500 only from kn Install KB5082123. Install KB5082142. Install KB5082200. Install KB5082063. Install KB5083769. Install KB5082052. Install KB5082060. Install KB5083768. Install KB5082198.

Review the complete instructions on the vendor's site
Timeline

When this advisory changed

  1. Published by Microsoft Security Response Center

    The publication date reported by the vendor.

  2. Updated by Microsoft Security Response Center

    The vendor changed the advisory after it was first published.

  3. Added to SecurityAlert

    We collected the advisory from the official source.

Vulnerabilities

CVEs named in this advisory

CVE-2026-33824View CVSS, KEV, EPSS, and threat context
Keep investigating
See every advisory from this vendor