An unauthenticated RCE in Windows IKE is now exploited over UDP 500 and 4500

August 18, 2026. CISA adds CVE-2026-33824 to its Known Exploited Vulnerabilities (KEV) catalog. April 2026, Microsoft patched the flaw in its monthly release. August 2026, attackers are already using it in the wild. Four months between the two: exactly the window an unpatched network perimeter hands an attacker.

The flaw lives in Windows IKE, the component that negotiates IPsec tunnels — in other words, the lock on your VPN. It requires no authentication at all: one packet is enough to run code.

A double free in the key exchange

The vulnerability sits in MS-IKEE, the extensions Microsoft layered on top of the IKE (Internet Key Exchange) protocol. Those extensions add CGA (cryptographically generated addresses) authentication, denial-of-service protection, and smoother interoperability with non-IPsec peers.

Microsoft’s description fits on one line: “Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.” In practice, an unauthenticated attacker sends specially crafted packets to a Windows machine with IKEv2 enabled, on UDP port 500 (initial negotiation) or UDP port 4500 (NAT traversal). The double free corrupts memory and leads to remote code execution.

The blast radius is broad. Every supported Windows 10, Windows 11, and Windows Server release is affected. This is not some exotic workstation bug — it is the network stack of the servers that expose a VPN service to the internet.

Four months between the fix and the exploitation

The timeline is the real story. Microsoft shipped the patch in April 2026. On August 18, 2026, CISA confirmed active exploitation and ordered U.S. Federal Civilian Executive Branch (FCEB) agencies to remediate within three days, under Binding Operational Directive 26-04.

The telling detail: Microsoft has still not updated its advisory to flag the flaw as exploited. CISA did it instead. That gap matters — it is a reminder that the KEV often confirms faster than the vendor that a patched flaw has become an exploited one.

CISA puts it bluntly: “This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.” The directive binds only U.S. government agencies, but the agency is urging every network defender to prioritize the fix.

Why ports 500 and 4500 are your forgotten perimeter

A VPN gateway is, by definition, exposed to the internet — that is its job. But it is often treated as a “trusted” appliance, patched on a firmware cadence rather than a CVE cadence. This flaw punishes exactly that bias.

UDP 500 and UDP 4500 are not filtered by default in most organizations: they have to stay open for tunnels to form. The result is that the attacker does not need to bypass an application firewall — the entry point is the protocol itself.

The extra trap is unawareness of exposure. This is not only about dedicated VPN appliances: Windows Server’s RRAS (Routing and Remote Access) and DirectAccess roles enable the IKEEXT service as soon as any VPN or routing feature is configured. Many organizations therefore expose this component without knowing it, on servers they do not classify as “VPN gateways”. Mapping must not stop at appliances — it should query IKEEXT on every Windows server. And cross-reference that map against the KEV weekly: every new entry points at a flaw real actors are exploiting right now. The three-day federal deadline is simply the fastest pace at which a large organization can realistically patch, and outside government the same attackers and the same exploit apply — only the deadline is self-imposed.

The surrounding context makes the threat concrete. Since November 2021, CISA has tagged 385 actively exploited Microsoft vulnerabilities, 112 of which ransomware gangs have also used. This week the agency separately confirmed that flaws in Windows Task Host and SharePoint are now being abused in ransomware operations. An unauthenticated network RCE on a VPN gateway is precisely the kind of initial access those groups monetize within days.

Detect exploitation before you patch

A double free deserves a short aside: the same block of memory is freed twice. The first free hands the region back to the system, the second frees it again and corrupts the allocator. An attacker who controls the contents of IKE packets then writes their own data to an address they control and hijacks the execution flow. The bug class is old, but its location makes it exceptional: IPsec negotiation happens before authentication, so no account is required to reach the vulnerable code.

Patching is not enough if you do not know which machines are listening. Map the exposure first:

# Which processes listen on UDP 500 and 4500?
Get-NetUDPEndpoint -LocalPort 500,4500 | Select-Object LocalAddress, LocalPort, OwningProcess

Then establish a baseline for IKE traffic: a spike of inbound UDP packets to 500/4500 from addresses that are not known VPN peers is the most reliable signal of an exploitation attempt. Your NetFlow/IPFIX collectors and firewall logs are enough.

Finally, a machine compromised before the patch stays compromised after it. Once patched, watch for unusual outbound connections from VPN servers: the sign that code was executed, not just that a packet arrived. And keep the month’s context in mind — the August 2026 Patch Tuesday fixed two more pre-authentication RCEs in QUIC (CVE-2026-62815) and Windows DNS (CVE-2026-62878). IKE, QUIC, DNS: Windows’ exposed-by-design network stack is the hunting ground of the moment.

Patch, or close the network door

The patch is the clean path: a standard monthly update with no special prerequisites, applied to every server that exposes IKE. Before patching, two commands tell you where you stand:

# Is the IKE and AuthIP IPsec Keying Module running on this machine?
Get-Service IKEEXT | Select-Object Status, StartType

# If IKE is not required: block inbound UDP 500 and 4500
New-NetFirewallRule -DisplayName "Block IKE inbound" `
  -Direction Inbound -Protocol UDP -LocalPort 500,4500 -Action Block

For teams that cannot patch immediately, Microsoft offers two network mitigations:

• Block inbound traffic on UDP 500 and 4500 on systems that do not use IKE;
• Restrict inbound traffic by firewall rule to known peer addresses only, where IKE is genuinely required.

These rules turn an unauthenticated RCE into an unreachable target. But they do not replace the patch: a known peer can be compromised in turn, and it then becomes the entry point.

Verdict

This flaw is not sophisticated — it is perimeter-defining. A double free in the component that establishes your VPN tunnels, exploitable without authentication on ports you must leave open, fixed in April and exploited in August: that is precisely the scenario the KEV exists to short-circuit.

The decision is binary. If you expose an IPsec/IKE gateway to the internet, apply CVE-2026-33824 within 72 hours — the same window BOD 26-04 imposes on federal agencies, and there is no reason to hold yourself to a lower bar. If IKE is not in use on a machine, block inbound UDP 500 and 4500 immediately: you close the door before you have even patched.

What holds for this flaw holds for the whole estate: a network vulnerability that is fixed but not patched is a vulnerability that is still open. The KEV tells you which ones are actually being hit — the rest is execution. Start with the machines that terminate IPsec today: you will almost certainly find at least one that was never in your patching scope, and that is precisely the one an attacker will reach first.

References

• BleepingComputer, “Critical RCE flaw in Windows IKE Extension now actively exploited”, August 19, 2026.
• CISA, “CISA Adds Four Known Exploited Vulnerabilities to Catalog”, August 18, 2026.
• Microsoft MSRC, “CVE-2026-33824 — Windows IKE Extension Remote Code Execution Vulnerability”, April 2026.
• NVD, “CVE-2026-33824”.