Remote code execution affecting Windows Internet Key Exchange (IKE) service extensions
A critical vulnerability affecting the Windows Internet Key Exchange (IKE) service extensions would allow an unauthenticated, remote attacker to execute arbitrary code on affected systems.
Description
Technical context and vulnerability details
Windows Internet Key Exchange (IKE) is a Microsoft service for establishing and managing secure communications, particularly for VPN connections using the IPsec protocol. The extensions of this service are affected by a vulnerability labeled CVE-2026-33824, resulting from a memory management error. Its exploitation would allow a remote, unauthenticated malicious actor to send specially crafted network packets to the affected service, in order to cause memory corruption and execute code on the affected system. This vulnerability is classified as critical, with a severity score of 9.8 according to CVSS v3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote arbitrary code execution on the affected system;
- Access, modification or deletion of data;
- Potential use of the compromised system as an entry point to the internal network;
Affected systems
Products, components and targeted versions
- Windows 10, versions 1607, 1809, 21H2 and 22H2;
- Windows 11, versions 23H2, 24H2, 25H2 and 26H1;
- Windows Server 2016, 2019, 2022 and 2025;
- Any system on which the IKE service (IKEEXT) is enabled and exposed, including via UDP ports 500 and 4500;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Apply security updates released by Microsoft;
- Identify systems using or exposing the IKE service;
- Restrict access to UDP ports 500 and 4500 when possible;
- Monitor suspicious activity related to the IKE service;
Sources & External Links
Vendor security advisories and documentation
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824
- https://nvd.nist.gov/vuln/detail/CVE-2026-33824
- https://www.microsoft.com/en-us/msrc/blog/2026/04/202604-security-update/
- https://www.microsoft.com/en-us/security/blog/2026/05/12/defense-at-ai-speed-microsofts-new-multi-model-agentic-security-system-finds-16-new-vulnerabilities/
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.