Critical Microsoft IKE Vulnerability Exploited in Attacks, CISA Warns
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-33824, a critical vulnerability in Microsoft’s Internet Key Exchange (IKE) Service Extensions, to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation. The flaw, which enables remote code execution (RCE), was disclosed on August 18, 2026, with federal agencies and covered organizations given until August 21, 2026, to apply patches under Binding Operational Directive (BOD) 26-04.
The vulnerability stems from a double-free memory corruption issue (CWE-415) in the IKE protocol, a core component of IPsec VPN deployments. Attackers could exploit it to crash services, leak data, or execute malicious code particularly on systems exposing IKE services to the internet. Successful exploitation could grant threat actors a foothold on VPN endpoints or perimeter devices, posing risks for initial access, espionage, or ransomware operations.
While Microsoft has not linked the flaw to specific ransomware campaigns, RCE vulnerabilities in exposed network services are highly prized by threat actors, including initial-access brokers and state-sponsored groups, as they bypass the need for phishing or stolen credentials.
Organizations are urged to patch immediately, prioritizing systems running Microsoft IKE Service Extensions. Those unable to patch should restrict IKE traffic (UDP ports 500/4500) to trusted networks, isolate affected hosts, and monitor for suspicious activity, such as malformed connection attempts or unusual process execution. Temporary workarounds are not a substitute for Microsoft’s official fix, and unpatched systems should be discontinued or isolated if mitigation is infeasible.
CISA’s directive underscores the urgency of addressing the flaw, given its potential to compromise VPN infrastructure and enterprise networks. Security teams are advised to review perimeter logs, IPsec telemetry, and endpoint alerts for signs of exploitation.
Source: https://cybersecuritynews.com/microsoft-internet-key-exchange-rce-vulnerability/
Microsoft TPRM report: https://www.rankiteo.com/company/microsoft-security-response-center
"id": "mic1787163871",
"linkid": "microsoft-security-response-center",
"type": "Vulnerability",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Organizations using Microsoft '
'IKE Service Extensions',
'industry': 'Software',
'location': 'Global',
'name': 'Microsoft',
'type': 'Technology Vendor'}],
'attack_vector': 'Remote Exploitation',
'date_publicly_disclosed': '2026-08-18',
'description': 'CISA has added CVE-2026-33824, a critical vulnerability in '
'Microsoft’s Internet Key Exchange (IKE) Service Extensions, '
'to its Known Exploited Vulnerabilities (KEV) catalog after '
'confirming active exploitation. The flaw enables remote code '
'execution (RCE) and stems from a double-free memory '
'corruption issue in the IKE protocol, a core component of '
'IPsec VPN deployments. Successful exploitation could grant '
'threat actors a foothold on VPN endpoints or perimeter '
'devices, posing risks for initial access, espionage, or '
'ransomware operations.',
'impact': {'operational_impact': 'Potential service crashes, data leaks, or '
'malicious code execution',
'systems_affected': 'VPN endpoints, perimeter devices, IPsec VPN '
'deployments'},
'initial_access_broker': {'entry_point': 'Exposed IKE services (UDP ports '
'500/4500)',
'high_value_targets': 'VPN endpoints, perimeter '
'devices'},
'motivation': ['Initial Access', 'Espionage', 'Ransomware Operations'],
'post_incident_analysis': {'corrective_actions': ['Apply Microsoft’s official '
'patch',
'Restrict IKE traffic to '
'trusted networks',
'Monitor for exploitation '
'attempts'],
'root_causes': 'Double-free memory corruption '
'issue (CWE-415) in IKE protocol'},
'recommendations': ['Patch immediately',
'Prioritize systems running Microsoft IKE Service '
'Extensions',
'Discontinue or isolate unpatched systems if mitigation '
'is infeasible'],
'references': [{'source': 'CISA Known Exploited Vulnerabilities (KEV) '
'catalog'}],
'regulatory_compliance': {'regulatory_notifications': ['Binding Operational '
'Directive (BOD) '
'26-04']},
'response': {'containment_measures': ['Restrict IKE traffic (UDP ports '
'500/4500) to trusted networks',
'Isolate affected hosts',
'Monitor for suspicious activity'],
'enhanced_monitoring': ['Review perimeter logs',
'IPsec telemetry',
'Endpoint alerts'],
'remediation_measures': ['Apply Microsoft’s official patch']},
'title': 'Critical Microsoft IKE Vulnerability Exploited in Attacks, CISA '
'Warns',
'type': 'Vulnerability Exploitation',
'vulnerability_exploited': 'CVE-2026-33824 (Double-free memory corruption in '
'IKE protocol)'}