CVE-2026-33824: Unauthenticated Windows IKE RCE on UDP 500/4500 Is Now Exploited — Four Months After the Patch

Introduction

CISA put CVE-2026-33824 on KEV on August 18 and gave federal agencies three days. Microsoft had already shipped the fix in the April 14, 2026 security updates. The bug is a double-free in Windows IKE Service Extensions (ikeext). An unauthenticated attacker sends crafted packets to a Windows host with IKEv2 enabled on UDP 500 (IKE) or UDP 4500 (NAT-T) and gets remote code execution. No user click. If you still have an internet-facing RRAS / IKEv2 / IPsec gateway that missed April's rollup, you have been a four-month sitting target.

What Happened

Microsoft's advisory is one sentence: "Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network." It hits supported Windows 10, Windows 11, and Windows Server. Microsoft told BleepingComputer it has not separately flagged the CVE as exploited in its own advisory; CISA's KEV entry is the exploitation signal. Microsoft also published a mitigation for teams that cannot patch immediately: block inbound UDP 500 and 4500 on machines that do not speak IKE, or allow those ports only from known peer addresses where IKE is required.

The interesting operational fact is who is actually exposed. A laptop behind NAT that is an IKE initiator is not the same as a Windows box answering IKE from the internet. Unit 42-style reporting and follow-ups put the urgency on responders: RRAS, Always On VPN / IKEv2 remote access, and Windows IPsec gateways with 500/4500 mapped through the firewall.

CISA's August 18 KEV batch also included VMware vCenter CVE-2026-59310 (already covered here after the September ransomware flag), a SharePoint weak-auth CVE, and an Apple macOS authentication issue. The IKE bug is the one that turns a forgotten Windows VPN into unauthenticated RCE.

Why It Matters

UDP 500/4500 are the ports every IPsec admin leaves open "because VPN." Memory corruption in that parser is 2010s-era edge RCE in 2026 clothing. Four months between patch and KEV is the exact window ransomware and initial-access brokers live on. If your change calendar treated April Patch Tuesday as optional for "the VPN box," CISA just made the argument for you.

Who Is Affected

  • Any still-unpatched Windows 10 / 11 / Server build from before the April 2026 cumulative, especially with IKEEXT running
  • Internet-reachable RRAS, IKEv2 VPN, and IPsec gateways
  • Hosts that do not use IKE but still allow inbound 500/4500 (unnecessary exposure)
  • Systems that installed April or later updates — Microsoft says those are protected; no extra action for the CVE itself

How to Protect Yourself

1. Patch to April 2026 or any later cumulative, then reboot.

Get-HotFix | Where-Object { $_.InstalledOn -ge [datetime]'2026-04-14' } |
  Sort-Object InstalledOn -Descending | Select-Object -First 10
Get-Service IKEEXT | Format-List Name, Status, StartType
Get-NetUDPEndpoint -LocalPort 500,4500 -ErrorAction SilentlyContinue

Match the exact KB for your SKU on the MSRC page for CVE-2026-33824.

2. If you cannot patch this hour, close the ports.

# machines that are not IKE responders
New-NetFirewallRule -DisplayName 'Block IKE UDP 500' -Direction Inbound -Protocol UDP -LocalPort 500 -Action Block
New-NetFirewallRule -DisplayName 'Block NAT-T UDP 4500' -Direction Inbound -Protocol UDP -LocalPort 4500 -Action Block

Where IKE is required, replace -Action Block with an allow-list of known peer IPs on the edge firewall / NSG / security group, not just the local Windows firewall.

3. Hunt the public path, not only the service. Get-NetUDPEndpoint shows local listeners. Also check NAT, load balancers, and cloud security groups for 500/4500 from 0.0.0.0/0.

4. Assume an internet-exposed unpatched responder may already be owned. Snapshot, review inbound 500/4500 traffic since April, look for unexpected processes spawned by svchost hosting IKEEXT, rotate VPN PSKs and machine certs, and rebuild if you cannot explain the traffic.

Source