CISA: Critical Windows IKE Vulnerability Already Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has reported that attackers have begun exploiting a critical remote code execution vulnerability in the Internet Key Exchange (IKE) service extensions component in Windows.

This set of additional capabilities, also known as MS-IKEE, was added by Microsoft to the IKE protocol. It includes authentication via Cryptographically Generated Addresses (CGA), denial-of-service protection, and simplified interaction with nodes that do not support IPsec.

How the Vulnerability Works

The flaw has been assigned the identifier CVE-2026-33824 and affects all supported releases of Windows 10, Windows 11, and Windows Server. At its core is a “double free” memory error. An attacker needs no privileges or authentication: it is enough to send specially crafted packets to UDP ports 500 or 4500 of a system with IKE version 2 enabled to achieve code execution.

Microsoft addressed the vulnerability back in April 2026, as part of its regular “Patch Tuesday.” For those who cannot install the patch immediately, the company recommends blocking inbound traffic on UDP ports 500 and 4500 on systems that do not use IKE, or configuring firewall rules to accept inbound connections only from known hosts.

An Order to Federal Agencies

Although Microsoft has not yet flagged the vulnerability as exploited, CISA has already added it to its catalog of actively exploited flaws. Under Binding Operational Directive BOD 26-04, federal civilian agencies are required to secure their devices within three days. The directive's requirements apply only to government bodies, but CISA has urged all network administrators to prioritize installing the update in order to stop the ongoing attacks.

This is not the only alarming news of recent days. Earlier, CISA confirmed that a vulnerability in the Windows Task Host, flagged as exploited back in April, is now being used in ransomware attacks. A week earlier, the agency had warned that ransomware operators had begun exploiting an RCE vulnerability in Microsoft SharePoint.

According to CISA, since November 2021 the agency has recorded 385 actively exploited vulnerabilities across various Microsoft products, 112 of which were used by ransomware groups. Representatives of CISA and Microsoft had not responded to a request for details about the current attacks at the time of publication.

Source: Bleeping Computer