CISA added CVE-2026-33824, a critical (CVSS 9.8) double free in the Microsoft Internet Key Exchange (IKE) Service Extensions, to the Known Exploited Vulnerabilities catalog on 2026-08-18 with a three-day remediation deadline of 2026-08-21.
What Is It
A double free (CWE-415) in the Windows IKE Extension allows an unauthorized attacker to execute code over a network. Microsoft rates it CVSS 3.1 base score 9.8 (CRITICAL), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, with total loss of confidentiality, integrity, and availability.
Why It Matters
CISA's SSVC assessment marks exploitation as active, automatable yes, and technical impact total. Its inclusion in the KEV catalog indicates CISA has evidence of exploitation in the wild, though no public technical details of observed attacks have been released. Known ransomware campaign use is listed as Unknown. The unauthenticated, no-interaction attack path against a network-facing service is the profile typically associated with mass automated exploitation, and CISA's automatable rating suggests scanning and opportunistic attacks are plausible. The NVD record also references Unit 42 reporting on an autonomous AI cyber attack campaign.
What's Vulnerable
Microsoft Windows IKE Extension across desktop and server builds:
| Product | Fixed in |
|---|---|
| Windows 10 1607 / Server 2016 (incl. Server Core) | 10.0.14393.9060 |
| Windows 10 1809 / Server 2019 (incl. Server Core) | 10.0.17763.8644 |
| Windows 10 21H2 | 10.0.19044.7184 |
| Windows 10 22H2 | 10.0.19045.7184 |
| Windows 11 23H2 | 10.0.22631.6936 |
| Windows 11 24H2 | 10.0.26100.8246 |
| Windows 11 25H2 | 10.0.26200.8246 |
| Windows 11 26H1 | 10.0.28000.1836 |
| Windows Server 2022 | 10.0.20348.5020 |
| Windows Server 2022 23H2 (Server Core) | 10.0.25398.2274 |
| Windows Server 2025 (incl. Server Core) | 10.0.26100.8246 |
Windows Server 2025 and Windows 11 24H2 share the 26100 servicing branch and take the same fixed build. Confirm the exact build number for your specific SKU and update channel against the MSRC Update Guide before validating patch state, as branch-level build numbers are occasionally transcribed inconsistently across advisory feeds.
Affected platforms include 32-bit, x64, and ARM64 systems.
Patch Status
Patched builds are available from Microsoft. CISA's required action: apply mitigations per vendor instructions in accordance with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and adhering to BOD 26-04 patching guidelines. Due date: 2026-08-21.
Sources
- Microsoft MSRC Update Guide; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-33824
- NVD CVE-2026-33824; https://nvd.nist.gov/vuln/detail/CVE-2026-33824
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33824
- CISA BOD 26-04; https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- CISA BOD 26-04 Implementation Guidance / Forensics Triage Requirements; https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- Unit 42, Autonomous AI Cyber Attack Campaign, https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/