Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
TL;DR 📌
- Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.
- Highest CVSS: 9.8 (Critical).
- Listed in CISA KEV (2026-08-18) — this is being exploited in the wild.
- Check the advisory for fixed releases — remediation detail is in the vendor link below.
- CVEs: CVE-2026-33824.
What it is
CVE-2026-33824 is a double free vulnerability in Microsoft’s Internet Key Exchange (IKE) Service Extensions. The IKE service handles key negotiation for IPsec, and on Windows this typically runs as part of the IKE/AuthIP IPsec Keying Modules service, which listens on the network to negotiate security associations with peers.
The CVSS vector indicates the flaw is reachable over the network, requires low attack complexity, and needs no privileges or user interaction to trigger. That places it on the data plane of IPsec negotiation rather than behind any management interface or authentication step. A double free in this context means the service frees the same memory region twice during processing, corrupting heap state in a way that can be steered towards code execution.
The impact rating covers confidentiality, integrity and availability, all rated high, and the overall score is 9.8 (critical). Successful exploitation gives an attacker remote code execution, in the context of the vulnerable IKE service, without needing an account on the target or any action from a user.
The vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalogue, added 18 August 2026, so it is known to be exploited.
What to do
- Check the Microsoft advisory for CVE-2026-33824 for the specific fixed builds — no fixed releases were available at the time of writing, so track the advisory for updates rather than assuming a patch date.
- Because this is in CISA KEV, prioritise this above routine patching cycles once a fix is published; treat any host running the IKE/AuthIP IPsec Keying Modules service as exposed until patched.
- Where patching cannot happen immediately, review exposure of IKE/IPsec services to untrusted networks and restrict access to only the peers that need it (e.g. via firewall rules limiting UDP 500/4500 to known VPN endpoints).
- Monitor the affected service for crashes or restarts, which can indicate exploitation attempts against the double free condition.
- Confirm whether the IKE/AuthIP service is running on internet-facing or otherwise exposed systems in your estate, and treat those as the highest priority for remediation.
For leadership 🧭
Executive summary. Risk is Critical (CVSS 9.8) across any Microsoft kit you run. Follow the remediation in the vendor advisory within Immediate — CISA KEV entries carry a federal remediation deadline.
Why it matters:
- Exposure depends on deployment topology and which access paths reach the affected component.
- Treat internet-facing and management-plane instances as higher risk than internal-only ones.
- Keep monitoring for abnormal authentication and configuration events until upgrades complete.
Now / Next / Later:
- Now: confirm whether you run the affected versions, and check exposure of any that are internet-facing.
- Next: apply the remediation the advisory specifies, through an approved change window.
- Later: add a control check so builds cannot drift back onto a vulnerable train.