[HIGH PRIORITY] Windows IKE Service Double-Free RCE (CVE-2026-33824)

⚠ HIGH PRIORITY — CISA KEV (Aug 2026). CVE-2026-33824 is a double-free memory corruption bug in Microsoft Windows Internet Key Exchange (IKE) Service Extensions. Unauthenticated remote attackers send crafted UDP packets to achieve remote code execution — no user interaction required.

Affected systems

• Windows Server and Windows client builds listed in Microsoft MSRC advisory
• Systems with IKE and AuthIP IPsec Keying Modules service running
• VPN gateways, domain controllers, and edge Windows servers on UDP 500/4500

Check exposure

Get-Service IKEEXT | Select Name, Status, StartType
Get-WindowsFeature RemoteAccess | Select InstallState
netstat -an | findstr ":500 :4500"

Patching Method

1. Install August 2026 (or later) cumulative Windows security update from WSUS/Intune.
2. Reboot server after patch — IKEEXT service restart alone is insufficient.
3. Confirm KB number matches Microsoft advisory for CVE-2026-33824.
4. On Linux-managed fleets: patch Windows VMs via WSUS or SCCM maintenance window.
5. Review Windows Event Log (System) for IKEEXT crashes before patch date.
6. Block UDP 500/4500 at perimeter firewall for non-VPN hosts as defense-in-depth.

systeminfo | findstr KB
Get-HotFix | Sort-Object InstalledOn -Descending | Select -First 5

Workaround (temporary)

• Disable IKEEXT service only if IPsec/VPN is not required on that host
• Restrict UDP 500/4500 to known VPN peer IPs at firewall
• Prioritize internet-facing and domain-joined servers first

CVSS: 9.8 Critical. Confirmed exploited in the wild.