CVE-2026-33824 — Microsoft Internet Key Exchange (IKE) Service Extensions: Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

1. Executive summary

CVE-2026-33824 is a critical (CVSS 9.8) double free vulnerability (CWE-415) in the Microsoft Windows Internet Key Exchange (IKE) Service Extensions. It enables an unauthenticated, remote attacker to execute arbitrary code over a network, resulting in total technical impact. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalogue on 2026-08-18, confirming active exploitation. EMEA financial services running affected Windows versions with IKE/IPsec VPN services exposed to the internet face an immediate risk of unauthenticated remote code execution on perimeter infrastructure.

2. Regulatory framing

3. Technical analysis & attack chain

Vulnerability mechanism: A double free condition (CWE-415) exists in the Windows IKE Extension. The NVD description states: "Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network." The CISA Coordinator record (SSVC v2.0.3) classifies the vulnerability as automatable (yes) with total technical impact. The exploitation state transitioned from "none" (assessed 2026-04-15) to "active" (assessed 2026-08-18).

Attack chain (confirmed steps)

1. Reconnaissance: The attacker identifies a target running a vulnerable Windows version with the IKE service reachable over the network (UDP port 500/4500 for IKE/IPsec).
2. Trigger double free: The unauthenticated attacker sends a crafted IKE negotiation packet to the target's IKE service, triggering the double free condition in the IKE Extension memory management.
3. Remote code execution: The corrupted heap state is leveraged to redirect execution to attacker-controlled shellcode, achieving code execution in the context of the IKE service.
4. Post-exploitation: With code execution achieved on the perimeter host, the attacker can pivot internally, exfiltrate data, or establish persistence.

Affected versions (from NVD CPE data)

Attribution: No threat actor attribution is available in the source material. The NVD record references a Unit42 advisory (hxxps://unit42[.]paloaltonetworks[.]com/autonomous-ai-cyber-attack-campaign/) as a third-party advisory; however, the content of that advisory was not provided in the source corpus. Attribution remains unconfirmed.

Confidence caveat: The active exploitation state is corroborated by both the CISA KEV catalogue entry and the CISA Coordinator SSVC record. The specific exploitation mechanism and post-exploitation behaviours are single-sourced from the NVD/CISA metadata; no vendor advisory or threat report with technical exploitation detail was available in the provided sources. Verify before enforcement of behavioural detections.

4. Mitigation & containment

P1 — Within 24 hours

• Identify exposed assets: Enumerate all Windows hosts running IKE/IPsec VPN services (UDP 500, UDP 4500) that are internet-facing. Priority: perimeter VPN gateways, DirectAccess servers, and any Windows Server running Routing and Remote Access Service (RRAS) with IKE enabled.
• Block at network perimeter: If IKE/IPsec VPN is not a business requirement on a given host, block UDP 500 and UDP 4500 at the external firewall. This eliminates the remote attack vector.
• Patch: Apply the vendor security update to bring all affected hosts to the fixed versions listed in §3. CISA's KEV entry sets a due date of 2026-08-21.

P2 — Within 72 hours

• Internal scan: Run authenticated vulnerability scans across the estate to identify any internal Windows hosts running vulnerable IKE service versions that may be reachable laterally.
• EDR coverage: Confirm EDR agents are deployed on all hosts identified as running IKE services. Monitor for anomalous process spawning from the IKE service host process (svchost.exe hosting the IKE service) or unexpected network connections initiated by the service account.
• Network segmentation: Ensure IKE/IPsec VPN endpoints are isolated in a DMZ and cannot pivot directly into core financial systems without traversing additional controls.

P3 — Within 7 days

• Verify patch deployment: Re-scan all previously identified vulnerable hosts to confirm remediation. Validate that the fixed build numbers match those in §3.
• Review VPN architecture: Assess whether IKEv1 is still required; if only IKEv2 is needed, disable IKEv1 at the policy level to reduce attack surface (note: this is a hardening measure, not a remediation for this CVE).
• Threat hunt: On hosts that were exposed prior to patching, hunt for signs of successful exploitation — review Windows Event Logs for IKE service crashes (Event ID 7034/7031), unexpected service restarts, and any anomalous child processes of the IKE service host.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules.

The source material provides no file hashes, distinctive strings, mutex names, command-line artefacts, or other threat-specific indicators that would support a functional YARA or Sigma rule. The behavioural indicators in §5 are based on expected exploitation patterns for a double free in a network service and should be implemented as custom EDR/SIEM correlation rules rather than portable detection signatures.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• NVD — CVE-2026-33824 Detail — https://nvd.nist.gov/vuln/detail/CVE-2026-33824 — 2026-08-17
• CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33824 — 2026-08-18
• Unit42 / Palo Alto Networks — Autonomous AI Cyber Attack Campaign (referenced as Third Party Advisory in NVD) — https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/ — date not confirmed (single-sourced; content not available in provided corpus)

8. Adverse Trace position

CVE-2026-33824 is a CVSS 9.8 CRITICAL double free vulnerability in a core Windows network service (IKE) that is actively exploited in the wild per CISA KEV (added 2026-08-18, EPSS 56%). The attack vector is unauthenticated and remote, the vulnerability is automatable, and the technical impact is total. For EMEA financial services, the primary exposure is on internet-facing Windows hosts terminating IKE/IPsec VPN connections — typically perimeter VPN gateways and DirectAccess servers. Clients should treat patching as urgent (CISA due date 2026-08-21) and immediately assess whether IKE services can be blocked at the perimeter while patches are applied. Attribution is unconfirmed and the referenced Unit42 advisory was not available in the source corpus; we will monitor for technical exploitation details and update this advisory if IOCs or actor attribution emerge.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.