Critical Actively exploited

CVE-2026-33824

Microsoft Internet Key Exchange (IKE) Service Extensions

Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

What this means

Likelihood: Exploitation is not hypothetical: CISA has observed it in the wild.

What to doTop priority: CISA sets the remediation deadline at 21 August 2026.

Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.

Published: 18 August 2026
CVSS: —
EPSS: 72.7% probability of exploitation within 30 days · above 99% of all CVEs
Weakness: CWE-415
CISA due date: 21 August 2026 past due
Sources: cisa-kev

Our analysis An unauthenticated RCE in Windows IKE is now exploited over UDP 500 and 4500

References

https://nvd.nist.gov/vuln/detail/CVE-2026-33824