{"id":"windows-ike-code-execution-apr-2026","category":"patch","status":"closed","title":"Windows IKE code-execution flaw CVE-2026-33824 exploited; April security updates fix it","tldr":"Attackers are using CVE-2026-33824 to target Windows systems with IKEv2 enabled. Windows 10, Windows 11 and Windows Server are affected. Install current Windows security updates; Microsoft's April 2026 fixes already protect against this flaw.","summary":"CVE-2026-33824 is a memory-handling flaw in Windows Internet Key Exchange (IKE) Service Extensions, used for secure network connections. An attacker who can reach an affected system with IKEv2 enabled could run code without signing in or getting someone to click anything. Microsoft disclosed and patched it on 14 April 2026. In July, Unit 42 reported manual exploitation attempts against three IKE VPN endpoints; CISA confirmed exploitation through its catalogue listing on 18 August. Microsoft subsequently confirmed that customers who installed the April fix were protected. Its affected-product list covers Windows 10, Windows 11 and Windows Server, with fixed builds available for every listed branch. As of 3 November, the reviewed sources do not establish the total number of victims or that attacks have stopped.","action":"On family Windows PCs, open Settings → Windows Update, install current security updates and restart when asked. Ask your IT provider to confirm that any Windows VPN servers have the April 2026 fix or a later cumulative update; Microsoft says systems already carrying that fix need no further action for this flaw.","product":"Microsoft Windows 10, Windows 11 and Windows Server (IKE Service Extensions)","audience":"both","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-33824"],"tags":["microsoft","windows","windows-server","vpn","remote-code-execution","actively-exploited"],"affected":["Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9060","Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.8644","Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7184","Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7184","Windows 11 Version 23H2 (ARM64 and x64): 10.0.22631.0 to before 10.0.22631.6936","Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.8246","Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.8246","Windows 11 version 26H1: 10.0.28000.0 to before 10.0.28000.1836","Windows Server 2016, including Server Core: 10.0.14393.0 to before 10.0.14393.9060","Windows Server 2019, including Server Core: 10.0.17763.0 to before 10.0.17763.8644","Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5020","Windows Server 2022, 23H2 Edition (Server Core installation): 10.0.25398.0 to before 10.0.25398.2274","Windows Server 2025, including Server Core: 10.0.26100.0 to before 10.0.26100.32690"],"fixed":["Windows 10 Version 1607: 10.0.14393.9060","Windows 10 Version 1809: 10.0.17763.8644","Windows 10 Version 21H2: 10.0.19044.7184","Windows 10 Version 22H2: 10.0.19045.7184","Windows 11 Version 23H2: 10.0.22631.6936","Windows 11 Version 24H2: 10.0.26100.8246","Windows 11 Version 25H2: 10.0.26200.8246","Windows 11 version 26H1: 10.0.28000.1836","Windows Server 2016, including Server Core: 10.0.14393.9060","Windows Server 2019, including Server Core: 10.0.17763.8644","Windows Server 2022: 10.0.20348.5020","Windows Server 2022, 23H2 Edition (Server Core installation): 10.0.25398.2274","Windows Server 2025, including Server Core: 10.0.26100.32690"],"matches":[{"platform":"windows","app":"Windows 10 Version 1607","bundle":"","fixed":"10.0.14393.9060"},{"platform":"windows","app":"Windows 10 Version 1809","bundle":"","fixed":"10.0.17763.8644"},{"platform":"windows","app":"Windows 10 Version 21H2","bundle":"","fixed":"10.0.19044.7184"},{"platform":"windows","app":"Windows 10 Version 22H2","bundle":"","fixed":"10.0.19045.7184"},{"platform":"windows","app":"Windows 11 Version 23H2","bundle":"","fixed":"10.0.22631.6936"},{"platform":"windows","app":"Windows 11 Version 24H2","bundle":"","fixed":"10.0.26100.8246"},{"platform":"windows","app":"Windows 11 Version 25H2","bundle":"","fixed":"10.0.26200.8246"},{"platform":"windows","app":"Windows 11 version 26H1","bundle":"","fixed":"10.0.28000.1836"}],"sources":[{"kind":"advisory","title":"Microsoft's CVE-2026-33824 record, including affected builds and CISA exploitation confirmation","url":"https://cveawg.mitre.org/api/cve/CVE-2026-33824","by":"Microsoft and CISA","date":"2026-10-15"},{"kind":"news","title":"Critical RCE flaw in Windows IKE Extension now actively exploited","url":"https://www.bleepingcomputer.com/news/security/cisa-critical-windows-ike-extension-flaw-now-exploited-in-attacks/","by":"BleepingComputer","date":"2026-08-21"},{"kind":"research","title":"Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks","url":"https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/","by":"Palo Alto Networks Unit 42","date":"2026-07-30"},{"kind":"post","title":"Unit 42 archive showing the research publication and revision dates","url":"https://unit42.paloaltonetworks.com/page/3/?search=cve-2026-31607%20redhat","by":"Palo Alto Networks Unit 42","date":"2026-08-11"},{"kind":"news","title":"CISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities","url":"https://www.securityweek.com/cisa-urges-immediate-patching-of-exploited-microsoft-vmware-apple-vulnerabilities/","by":"SecurityWeek","date":"2026-08-19"},{"kind":"advisory","title":"CVE-2026-33824 Detail","url":"https://nvd.nist.gov/vuln/detail/cve-2026-33824","by":"NIST NVD","date":"2026-09-25"}],"started":"2026-08-18","closed":"2026-08-21","created":"2026-11-03T22:18:10.647Z","updated":"2026-11-03T22:18:10.647Z","cve_notes":[{"cve":"CVE-2026-33824","name":"Double free in Windows IKE Service Extensions","what":"Windows IKE Service Extensions can free the same memory twice, allowing an unauthorised attacker to run code over a network.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-08-21","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Microsoft told BleepingComputer that its April security update protects against the flaw and that customers who installed it need no further action for this vulnerability.","url":"https://www.bleepingcomputer.com/news/security/cisa-critical-windows-ike-extension-flaw-now-exploited-in-attacks/","by":"BleepingComputer","patch":null},{"at":"2026-08-18","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-33824 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks.","url":"https://cveawg.mitre.org/api/cve/CVE-2026-33824","by":"Microsoft and CISA","patch":null},{"at":"2026-07-30","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Unit 42 reported a Chinese-speaking attacker using the flaw in manual attacks against three IKE VPN endpoints. Its findings describe attempts to establish remote command connections.","url":"https://unit42.paloaltonetworks.com/page/3/?search=cve-2026-31607%20redhat","by":"Palo Alto Networks Unit 42","patch":null},{"at":"2026-04-14","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Microsoft disclosed CVE-2026-33824 and released Windows security updates to fix it. The flaw allows remote code execution without signing in.","url":"https://www.bleepingcomputer.com/news/security/cisa-critical-windows-ike-extension-flaw-now-exploited-in-attacks/","by":"BleepingComputer","patch":"patched"}],"url":"https://hard.fyi/live/windows-ike-code-execution-apr-2026/","json":"https://hard.fyi/api/live?id=windows-ike-code-execution-apr-2026"}