NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Windows IKE code-execution flaw CVE-2026-33824 exploited; April security updates fix it

Attackers are using CVE-2026-33824 to target Windows systems with IKEv2 enabled. Windows 10, Windows 11 and Windows Server are affected. Install current Windows security updates; Microsoft's April 2026 fixes already protect against this flaw.

What to do

On family Windows PCs, open Settings → Windows Update, install current security updates and restart when asked. Ask your IT provider to confirm that any Windows VPN servers have the April 2026 fix or a later cumulative update; Microsoft says systems already carrying that fix need no further action for this flaw.

Check your devices
  • Windows 10 Version 1607fixed in 10.0.14393.9060 and later
  • Windows 10 Version 1809fixed in 10.0.17763.8644 and later
  • Windows 10 Version 21H2fixed in 10.0.19044.7184 and later
  • Windows 10 Version 22H2fixed in 10.0.19045.7184 and later
  • Windows 11 Version 23H2fixed in 10.0.22631.6936 and later
  • Windows 11 Version 24H2fixed in 10.0.26100.8246 and later
  • Windows 11 Version 25H2fixed in 10.0.26200.8246 and later
  • Windows 11 version 26H1fixed in 10.0.28000.1836 and later

What’s happening

CVE-2026-33824 is a memory-handling flaw in Windows Internet Key Exchange (IKE) Service Extensions, used for secure network connections. An attacker who can reach an affected system with IKEv2 enabled could run code without signing in or getting someone to click anything. Microsoft disclosed and patched it on 14 April 2026. In July, Unit 42 reported manual exploitation attempts against three IKE VPN endpoints; CISA confirmed exploitation through its catalogue listing on 18 August. Microsoft subsequently confirmed that customers who installed the April fix were protected. Its affected-product list covers Windows 10, Windows 11 and Windows Server, with fixed builds available for every listed branch. As of 3 November, the reviewed sources do not establish the total number of victims or that attacks have stopped.

What
Flaw
Affects
Microsoft Windows 10, Windows 11 and Windows Server (IKE Service Extensions)
Affected
Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9060
Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.8644
Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7184
Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7184
Windows 11 Version 23H2 (ARM64 and x64): 10.0.22631.0 to before 10.0.22631.6936
Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.8246
Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.8246
Windows 11 version 26H1: 10.0.28000.0 to before 10.0.28000.1836
Windows Server 2016, including Server Core: 10.0.14393.0 to before 10.0.14393.9060
Windows Server 2019, including Server Core: 10.0.17763.0 to before 10.0.17763.8644
Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5020
Windows Server 2022, 23H2 Edition (Server Core installation): 10.0.25398.0 to before 10.0.25398.2274
Windows Server 2025, including Server Core: 10.0.26100.0 to before 10.0.26100.32690
Fixed in
Windows 10 Version 1607: 10.0.14393.9060
Windows 10 Version 1809: 10.0.17763.8644
Windows 10 Version 21H2: 10.0.19044.7184
Windows 10 Version 22H2: 10.0.19045.7184
Windows 11 Version 23H2: 10.0.22631.6936
Windows 11 Version 24H2: 10.0.26100.8246
Windows 11 Version 25H2: 10.0.26200.8246
Windows 11 version 26H1: 10.0.28000.1836
Windows Server 2016, including Server Core: 10.0.14393.9060
Windows Server 2019, including Server Core: 10.0.17763.8644
Windows Server 2022: 10.0.20348.5020
Windows Server 2022, 23H2 Edition (Server Core installation): 10.0.25398.2274
Windows Server 2025, including Server Core: 10.0.26100.32690
CVE
CVE-2026-33824
Since
18 Aug 2026
Closed
21 Aug 2026

Timeline

  1. Vendor revised

    Microsoft told BleepingComputer that its April security update protects against the flaw and that customers who installed it need no further action for this vulnerability.

  2. CISA added

    CISA added CVE-2026-33824 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks.

  3. Update

    Unit 42 reported a Chinese-speaking attacker using the flaw in manual attacks against three IKE VPN endpoints. Its findings describe attempts to establish remote command connections.

  4. New fixFixed

    Microsoft disclosed CVE-2026-33824 and released Windows security updates to fix it. The flaw allows remote code execution without signing in.

Sources

  1. Microsoft's CVE-2026-33824 record, including affected builds and CISA exploitation confirmationMicrosoft and CISA · 15 Oct 2026
  2. Critical RCE flaw in Windows IKE Extension now actively exploitedBleepingComputer · 21 Aug 2026
  3. Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous CyberattacksPalo Alto Networks Unit 42 · 30 July 2026
  4. Unit 42 archive showing the research publication and revision datesPalo Alto Networks Unit 42 · 11 Aug 2026
  5. CISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple VulnerabilitiesSecurityWeek · 19 Aug 2026
  6. CVE-2026-33824 DetailNIST NVD · 25 Sept 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from August 2026 · JSON · RSS