The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding active exploitation of a critical remote code execution (RCE) vulnerability within the Windows Internet Key Exchange (IKE) Service Extensions component. This flaw, identified as CVE-2026-33824, affects all supported versions of Windows 10, Windows 11, and Windows Server.
Microsoft, in its April 2026 Patch Tuesday advisory, described CVE-2026-33824 as a "double free" vulnerability. It allows an unauthenticated attacker to execute code remotely by sending specially crafted packets to a Windows machine with IKE version 2 enabled. This can occur over UDP ports 500 or 4500.
The IKE Service Extensions, also known as MS-IKEE, are additional capabilities Microsoft integrated into the IKE Protocol. These extensions include features such as authentication via cryptographically generated addresses (CGAs), denial-of-service protection, and improved interoperability with non-IPsec capable peers.
While Microsoft has not yet updated its advisory to indicate active exploitation, CISA has added CVE-2026-33824 to its catalog of actively exploited vulnerabilities. This designation triggers a mandate under Binding Operational Directive 26-04, requiring U.S. Federal Civilian Executive Branch (FCEB) agencies to patch their systems within three days.
CISA emphasized that this type of vulnerability is a frequent target for malicious cyber actors and poses significant risks to federal systems. Although BOD 26-04 specifically applies to government agencies, CISA strongly urged all network defenders to prioritize patching CVE-2026-33824 to mitigate ongoing attacks.
For organizations unable to immediately install the security update, Microsoft previously recommended blocking inbound traffic through UDP ports 500 and 4500 on systems that do not utilize IKE. Alternatively, if IKE is in use, firewall rules can be configured to permit inbound traffic only from known peer addresses.
This alert follows other recent CISA warnings concerning actively exploited Microsoft vulnerabilities. In April, a high-severity Windows Task Host vulnerability was flagged as exploited, and it has since been linked to ransomware attacks. Additionally, in early July, CISA confirmed in-the-wild exploitation of a Microsoft SharePoint RCE vulnerability, which ransomware operations have also begun leveraging.
Since November 2021, CISA has identified 385 actively exploited vulnerabilities across various Microsoft products, with 112 of these also being exploited by ransomware groups.
