CVE intelligenceCISA KEV

CVE-2026-33824

Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

Published Apr 14, 2026Sources checked Nov 12, 2026

9.8CRITICALCVSS out of 10

What this means

Actively exploited

CISA lists CVE-2026-33824 in its Known Exploited Vulnerabilities catalog, which means exploitation has been observed. The entry applies to Microsoft Internet Key Exchange (IKE) Service Extensions.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Aug 20, 2026

Vendor remediation details

The following mitigating factors might be helpful in your situation: Customers who cannot immediately install the security update can take one of the following actions, depending on their environment: Block inbound traffic on UDP ports 500 and 4500 for systems that do not use IKE. For systems that require IKE, configure firewall rules to allow inbound traffic on UDP ports 500 and 4500 only from kn Install KB5082123. Install KB5082142. Install KB5082200. Install KB5082063. Install KB5083769. Install KB5082052. Install KB5082060. Install KB5083768. Install KB5082198.

Vendor-listed releases

10.0.17763.8644
10.0.20348.5020
10.0.19044.7184
10.0.19045.7184
10.0.26100.32690
10.0.26200.8246
10.0.22631.6936
10.0.25398.2274
10.0.26100.8246
10.0.28000.1836
10.0.14393.9060

CISA KEVListedObserved exploitation

EPSS77.1%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors1Source-linked actor relationships

Overview

What is CVE-2026-33824?

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

Source: NVD

CISA says:Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.CISA catalog due date Aug 21, 2026