The Cybersecurity and Infrastructure Security Agency (CISA) has issued a binding operational directive adding CVE-2026-33824 to its Known Exploited Vulnerabilities (KEV) catalog. The flaw affects the Internet Key Exchange (IKE) protocol extensions in Microsoft Windows, an integral component of the operating system's native IPsec VPN and network tunneling stack.

Holding a maximum-criticality CVSS v3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability enables an unauthenticated, remote attacker to achieve arbitrary code execution at the highest operating system privilege level (NT AUTHORITY\SYSTEM) with zero user interaction.

Vulnerability Mechanics: Asynchronous Packet State & Double-Free Trigger

According to vulnerability telemetry published by Microsoft Security Response Center (MSRC), the defect resides within ikeext.dll and the kernel-mode IPsec driver during the processing of IKE version 1 and version 2 handshake negotiations:

  1. Unauthenticated UDP Handshake Ingestion: The Windows IKE and AuthIP IPsec Keying Modules listen continuously for incoming connection handshakes on UDP port 500 and UDP port 4500 (NAT-Traversal).
  2. Malformed Security Association (SA) Payload: An adversary transmits a stream of specially crafted IKEv2 packets containing duplicate Security Association payloads with mismatched attribute lengths and corrupted vendor ID headers.
  3. Double-Free Memory Corruption: During packet cleanup and state machine error handling, an asynchronous race condition causes the allocation buffer for the security association context to be released twice. By spraying the Windows heap with deterministic memory allocations, the attacker overwrites function pointers to seize the instruction pointer (EIP/RIP) and execute arbitrary shellcode.

Because the Windows IKE service starts automatically and processes incoming handshake packets prior to any cryptographic authentication or certificate exchange, this flaw represents an unauthenticated, zero-click remote code execution vector against perimeter firewalls, VPN servers, and domain workstations.

Affected Windows Server & Desktop Releases

Operating System Platform Vulnerable Build Architecture Remediated Security Update CISA Remediation Mandate
Windows Server 2025 / 2022 (Datacenter & Standard) All unpatched base builds KB5043080 or later Cumulative Update Emergency Directive Action Required
Windows Server 2019 / 2016 All unpatched base builds KB5043051 or later Cumulative Update Emergency Directive Action Required
Windows 11 (24H2, 23H2, 22H2) & Windows 10 (22H2) x64 and ARM64 releases Latest Monthly Security Rollup Mandatory Patch Deployment

Detection, Audit & Firewall Mitigation Playbook

Enterprise network administrators and security operations centers must execute the following detection and mitigation directives immediately:

# Verify status of Windows IKE and AuthIP IPsec Keying Modules service
Get-Service -Name "IKEEXT"

# Inspect Windows Defender Firewall for active inbound UDP 500/4500 rules
Get-NetFirewallRule -DisplayName "*IPsec*" | Get-NetFirewallPortFilter

# Audit Windows System Event Log for IKEEXT service crashes
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Service Control Manager'; Id=7034} | Where-Object {$_.Message -like "*IKEEXT*"}

Recommended Enterprise Safeguards

  • Deploy Microsoft Cumulative Security Update: Prioritize emergency rollout of Microsoft security updates across all internet-facing Windows Server VPN gateways, DirectAccess servers, and domain controllers.
  • Perimeter Boundary Filtering: If IPsec VPN termination is handled by dedicated network hardware (such as Palo Alto or Fortinet appliances), block inbound UDP ports 500 and 4500 from reaching internal Windows servers at the enterprise boundary router.
  • Disable IKEEXT Service on Non-VPN Hosts: For internal application servers and workstations that do not terminate remote IPsec tunnels, disable the IKEEXT service to eliminate the attack surface entirely: 
    Stop-Service -Name "IKEEXT" -Force
Set-Service -Name "IKEEXT" -StartupType Disabled