IKEv2 packets can trigger code execution

CVE-2026-33824 is a double-free flaw in the Windows Internet Key Exchange Service Extensions. An unauthenticated attacker can send specially crafted packets to a Windows machine with IKEv2 enabled and execute code. No user interaction or existing account is required.

Microsoft rates the vulnerability Critical with a CVSS score of 9.8. The vector is entirely network-based, attack complexity is low, and the potential impact on confidentiality, integrity and availability is high. Systems accepting IKE/IPsec traffic for VPN, site-to-site or host connections are particularly relevant.

CISA added the CVE to its KEV catalog on August 18, 2026. The remediation deadline set there for US federal agencies expired on August 21. Microsoft still marks its own entry as “Exploited: No.” For operational prioritization, the KEV status should be treated as evidence of known exploitation.

Current cumulative updates include the fix

Microsoft first fixed the vulnerability in the Windows security updates released on April 14, 2026. Affected products include supported editions of Windows 10 and Windows 11 and Windows Server 2016 through 2025, including several Server Core variants. Because Windows updates are cumulative, the current August updates include the correction.

Common regular servicing channels should be at or above these levels:

  • Windows 10: version 1607 build 14393.9418 (KB5120418), 1809 build 17763.9121 (KB5120238), 21H2 build 19044.7663 and 22H2 build 19045.7663 (both KB5120249).
  • Windows 11: 23H2 build 22631.7517 (KB5120240), 24H2 build 26100.9168 and 25H2 build 26200.9168 (both KB5121003), and 26H1 build 28000.2704 (KB5121000).
  • Windows Server: 2016 build 14393.9418 (KB5120418), 2019 build 17763.9121 (KB5120238), 2022 build 20348.5499 (KB5120242), and 2025 build 26100.33296 (KB5120233).

Hotpatch, ESU and separate Server Core channels must be checked against their applicable Microsoft servicing level. Verify the installed KB, actual OS build and any pending restart.

Keep UDP 500 and 4500 tightly scoped

Update systems with a reachable IKEv2 service immediately. If that is not possible, Microsoft’s clarification published on August 20 lists two temporary measures:

  • Block inbound UDP 500 and 4500 on systems that do not use IKE.
  • On systems that require IKE, allow inbound traffic on those ports only from known peer addresses.

These rules reduce exposure but do not replace the security update. Before changing them, identify the VPN and IPsec connections that depend on the current access. Add previously exposed systems that were patched late to incident triage.

The immediate check: inventory IKEv2 use and reachability, verify current Windows builds, and limit UDP 500/4500 to required peers until patching is complete.