Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
TL;DR 📌
- Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.
- Highest CVSS: 9.8 (Critical).
- Listed in CISA KEV (2026-08-18) — this is being exploited in the wild.
- Check the advisory for fixed releases — remediation detail is in the vendor link below.
- CVEs: CVE-2026-33824.
What it is
CVE-2026-33824 is a double free vulnerability in Microsoft’s Internet Key Exchange (IKE) Service Extensions. The IKE service handles key negotiation for IPsec, and on Windows this typically runs as part of the IKE/AuthIP IPsec Keying Modules service, which listens on the network to negotiate security associations with peers.
The CVSS vector indicates the flaw is reachable over the network, requires low attack complexity, and needs no privileges or user interaction to trigger. That places it on the data plane of IPsec negotiation rather than behind any management interface or authentication step. A double free in this context means the service frees the same memory region twice during processing, corrupting heap state in a way that can be steered towards code execution.
The impact rating covers confidentiality, integrity and availability, all rated high, and the overall score is 9.8 (critical). Successful exploitation gives an attacker remote code execution, in the context of the vulnerable IKE service, without needing an account on the target or any action from a user.
The vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalogue, added 18 August 2026, so it is known to be exploited.
What to do
- Check the Microsoft advisory for CVE-2026-33824 for the specific fixed builds — no fixed releases were available at the time of writing, so track the advisory for updates rather than assuming a patch date.
- Because this is in CISA KEV, prioritise this above routine patching cycles once a fix is published; treat any host running the IKE/AuthIP IPsec Keying Modules service as exposed until patched.
- Where patching cannot happen immediately, review exposure of IKE/IPsec services to untrusted networks and restrict access to only the peers that need it (e.g. via firewall rules limiting UDP 500/4500 to known VPN endpoints).
- Monitor the affected service for crashes or restarts, which can indicate exploitation attempts against the double free condition.
- Confirm whether the IKE/AuthIP service is running on internet-facing or otherwise exposed systems in your estate, and treat those as the highest priority for remediation.
For leadership 🧭
Executive summary. A critical, unauthenticated remote code execution flaw in Windows’ IKE/AuthIP IPsec service is already being exploited in the wild, according to CISA’s Known Exploited Vulnerabilities catalogue. Any Windows host running this service and reachable over the network should be treated as at risk today, ahead of routine patch scheduling.
Why it matters:
- The flaw sits in the IKE/AuthIP IPsec Keying Modules service, which listens on the network (typically UDP 500/4500) to negotiate security associations, so no authentication or user interaction is needed to reach it.
- A double free in this service can corrupt heap state and be steered towards remote code execution, giving an attacker full confidentiality, integrity and availability impact on the host.
- CISA added this to its Known Exploited Vulnerabilities catalogue on 18 August 2026, meaning exploitation is already occurring, not theoretical.
- No fixed builds were confirmed at time of writing, so exposed hosts remain vulnerable until Microsoft publishes and you apply a patch.
Now / Next / Later:
- Now: Identify every Windows host running the IKE/AuthIP IPsec Keying Modules service and check whether it is reachable from untrusted networks, especially over UDP 500/4500.
- Next: Once Microsoft publishes fixed builds for CVE-2026-33824, apply them ahead of routine patch cycles given active exploitation; in the meantime restrict IKE/IPsec traffic to known VPN peer endpoints via firewall rules.
- Later: Establish monitoring for crashes or unexpected restarts of the IKE/AuthIP service as an indicator of exploitation attempts, and build a standing inventory of IPsec-exposed hosts for faster triage on future advisories.