CISA Warns Microsoft Internet Key Exchange RCE Flaw Is Actively Exploited

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Microsoft Internet Key Exchange (IKE) Service Extensions to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability, tracked as CVE-2026-33824, is currently being actively exploited.

The issue is classified as a double-free vulnerability, which means it affects the memory management of Microsoft IKE Service Extensions.

If successfully exploited, a remote attacker could execute arbitrary code on a vulnerable system, potentially leading to a complete compromise of that host.

Microsoft Internet Key Exchange RCE

Microsoft IKE Service Extensions are used to support Internet Protocol Security (IPsec) and virtual private network (VPN) connectivity by negotiating security associations between endpoints.

Because IKE is commonly accessible from external networks for remote-access VPN deployments, organizations should consider this vulnerability an urgent perimeter security issue.

CVE-2026-33824 is associated with CWE-415, known as “Double Free.” This type of memory safety vulnerability occurs when software mistakenly frees the same memory allocation more than once. An attacker could exploit this condition to corrupt memory, crash services, alter program execution flow, or execute malicious code.

For an IKE-facing service, remote code execution poses a significant risk. An attacker could potentially compromise a VPN or network security endpoint to establish persistence, move laterally within an internal network, steal credentials, or deploy additional malicious payloads.

While CISA has not determined whether this flaw has been used in ransomware campaigns, its inclusion in the KEV Catalog indicates active exploitation and necessitates immediate defensive action.

CISA added CVE-2026-33824 to the KEV Catalog on August 18, 2026, and has set a remediation deadline of August 21, 2026. This short window reflects the severe risk posed by exploiting this remotely accessible Microsoft service.

Federal civilian executive branch agencies are required to implement mitigations in accordance with vendor instructions and CISA’s Binding Operational Directive 26-04, which prioritizes security updates based on risk.

The agency has also instructed stakeholders to adhere to its forensics and triage requirements when responding to potentially affected assets.

Organizations outside the federal government should use the same deadline as an operational benchmark. Security teams are advised to identify systems running the affected Microsoft IKE Service Extensions, assess whether they are exposed to the internet, and apply Microsoft’s recommended mitigations as soon as possible.

Defenders should prioritize the following actions:

• Patch or mitigate affected Microsoft IKE Service Extensions according to vendor guidance.
• Identify externally exposed IPsec and VPN infrastructure, including devices and servers accepting IKE negotiations.
• Review logs for suspicious IKE traffic, failed or unusual authentication attempts, and unexpected service crashes.
• Conduct forensic triage on exposed systems to identify signs of compromise before and after remediation.
• Restrict unnecessary external access to IKE-enabled services through firewall rules and network segmentation.
• Discontinue use of affected products where mitigations are not available.

Given the potential for remote code execution on infrastructure that is often part of an organization’s remote-access perimeter, CVE-2026-33824 should be treated as a high-priority issue for patching and incident response.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC