CVE-2026-33824: Windows IKE Extension Double-Free RCE Now in CISA KEV

Background

Internet Key Exchange version 2 (IKEv2) is the negotiation protocol underlying most Windows VPN deployments — site-to-site tunnels, remote access VPNs, and Windows Always On VPN all rely on it to establish IPsec security associations. On Windows, this negotiation is handled by the IKE Extension, implemented in ikeext.dll and exposed to the network over UDP ports 500 and 4500 wherever a VPN or IPsec gateway role is enabled.

Microsoft patched CVE-2026-33824 in its April 2026 Patch Tuesday release. CISA added it to the Known Exploited Vulnerabilities catalog on August 18, 2026, with a remediation deadline of August 21 — a four-month gap between patch availability and confirmed in-the-wild exploitation that tracks a familiar pattern: unauthenticated, network-reachable memory corruption bugs get weaponised eventually, and organisations that treated the April patch as routine are now the ones exposed.

Technical Mechanism

CVE-2026-33824 is a double-free (CWE-415) rooted in improper pointer ownership during IKEv2 fragment reassembly. When the IKE Extension processes a Microsoft Security Realm Vendor ID payload, it shallow-copies a heap-allocated blob pointer into a work item rather than performing a deep copy. That work item and the original allocation inside the connection’s MMSA (Main Mode Security Association) structure end up aliased to the same memory.

The functions involved — IkeHandleSecurityRealmVendorId(), IkeReinjectReassembledPacket(), IkeDestroyPacketContext(), and IkeFreeMMSA() — each assume they hold exclusive ownership of the blob. They don’t. Under a specific sequence of packet handling, both the packet-context teardown path and the MMSA teardown path free the same allocation.

Exploitation requires no authentication and no user interaction, only network reachability to UDP 500 or 4500:

1. An attacker sends a crafted IKE_SA_INIT message containing a Microsoft Security Realm Vendor ID payload, causing the vulnerable blob to be allocated and shallow-copied into a work item.
2. The attacker follows with two or more Encrypted Fragment (SKF) payloads carrying a malformed IKE_AUTH message, triggering reassembly logic that frees the aliased pointer twice.

A double-free in a SYSTEM-privileged service is a well-trodden path to arbitrary code execution: an attacker who controls the timing and size of subsequent heap allocations can turn the corrupted free-list into a write primitive. At minimum, the bug crashes IKEEXT and disrupts VPN service; Microsoft’s advisory and Zero Day Initiative’s analysis both rate the ceiling as remote code execution with SYSTEM privileges.

Real-World Exploitation Evidence

CISA’s KEV addition confirms exploitation activity, though public detail on the threat actor or campaign scope is limited at time of writing. The exploitation profile fits the vulnerability class: no authentication barrier, a well-documented target service (any Windows host with IKE-based VPN enabled), and a network protocol that’s routinely exposed at organisational perimeters by design — IKE has to be internet-reachable for remote access VPN to function at all.

That combination — perimeter-facing, unauthenticated, SYSTEM-level — makes CVE-2026-33824 attractive for both opportunistic scanning and targeted intrusion. Security researchers flagged wormable potential given the lack of any interaction requirement.

Impact Assessment

A successful exploit gives an attacker code execution with SYSTEM privileges on the affected host, before any VPN authentication occurs. For organisations running Windows Server as a VPN or IPsec gateway, that host frequently sits at the network boundary with routes into internal segments — a compromise here is a foothold with an unusually direct path inward.

Beyond the immediate host, expect:

• Denial of service against VPN infrastructure even in failed exploitation attempts, since a triggered double-free crashes IKEEXT
• Potential lateral movement from a compromised gateway into internal network segments
• Disruption of Always On VPN and site-to-site tunnels relying on the affected host
• Elevated risk for any Windows Server exposing IKE to the internet without additional network-layer filtering

Affected Versions

Remediation Steps

1. Apply the April 2026 cumulative update immediately if it has not already been deployed. This is the single decisive action; there is no supported configuration change that fully closes the vulnerability short of patching.

2. Restrict UDP 500/4500 exposure where the patch cannot be applied in the short term. Limit IKE-facing interfaces to known VPN client IP ranges rather than leaving them open to the general internet.

3. Prioritise internet-facing VPN gateways in your patch rollout. Internal-only IPsec tunnels are lower priority than any Windows Server acting as a remote-access VPN endpoint.

4. Verify patch application via the installed update history on affected hosts rather than assuming a WSUS or SCCM deployment succeeded — confirm the April 2026 cumulative update is actually present.

5. Review VPN gateway logs for repeated IKE_SA_INIT and SKF fragment sequences from unfamiliar source IPs, which may indicate exploitation attempts predating patch deployment.

Detection Guidance

Network indicators:

Look for IKE_SA_INIT messages containing a Microsoft Security Realm Vendor ID payload followed in short succession by multiple Encrypted Fragment (SKF) payloads carrying malformed IKE_AUTH content — the two-stage pattern that triggers the double-free.

UDP 500/4500 → IKE_SA_INIT (Security Realm Vendor ID present)
UDP 500/4500 → 2+ SKF fragments, malformed IKE_AUTH

Host indicators:

Unexpected crashes or restarts of the IKEEXT service (IKE and AuthIP IPsec Keying Modules) are a strong signal, whether from failed or successful exploitation attempts. Check the System event log for service crash events correlated with IKEEXT around the time of suspicious network traffic.

SIEM query (generic firewall/IDS log):

protocol:udp AND dst_port:(500 OR 4500)
| stats count by src_ip, dst_ip
| where count > 3 within 60s

Elevated fragment counts from a single source IP within a short window against an IKE-facing host warrant investigation, particularly against internet-facing VPN gateways.

Timeline

References

• Zero Day Initiative — CVE-2026-33824: Remote Code Execution in Windows IKEv2
• CISA — Known Exploited Vulnerabilities Catalog
• CISA BOD 26-04 Guidance
• Action1 — CVE-2026-33824 Vulnerability Details