CVE-2026-33824: Windows IKE Extension Double-Free RCE (KEV)
CVE-2026-33824 is a double-free in the Windows IKE Extension that lets an unauthorized, unauthenticated attacker execute arbitrary code over the network against a Windows host with the IKE/IPsec VPN service reachable, and Palo Alto Networks' Unit 42 documents a Chinese-speaking threat actor actively exploiting it with reverse-shell attempts against IKE VPN endpoints.
Vulnerability summary
| Vulnerability ID | CVE-2026-33824 |
|---|---|
| CVSS score | 9.8 |
| EPSS score | 0.77054 |
| CISA KEV | Yes — in the Known Exploited Vulnerabilities catalog |
| Source | NVD (Microsoft MSRC Secondary score only, not NVD Primary) |
| Published | 2026-04-14T18:17:34.767 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| Microsoft Windows 10 / Windows 11 (client) | cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:* | Windows 10 1607, 1809, 21H2, 22H2; Windows 11 23H2, 24H2, 25H2, 26H1 (x86/x64/ARM64 builds, per NVD's configuration data) — each fixed by its own cumulative-update build listed in NVD's CPE match data |
| Microsoft Windows Server | cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* | Windows Server 2016, 2019, 2022, 2022 23H2, 2025 — each fixed by its own cumulative-update build listed in NVD's CPE match data |
What this means
CVE-2026-33824 is a double free (CWE-415) in the Windows Internet Key Exchange (IKE) Extension, the component that negotiates IPsec/L2TP VPN connections. NVD's description, taken directly from the Microsoft Security Response Center (MSRC) CVE record, states: "Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network" (NVD).
Microsoft's own MSRC advisory page renders its vulnerability details via client-side JavaScript and returned no static content when fetched this run, so this page relies on NVD's structured record plus third-party technical reporting rather than presenting unverified vendor text. NVD lists the CVE as "Analyzed" with a CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, attributed to Microsoft ([email protected]) as a CNA Secondary score — NVD has not published its own independent Primary metric for this record (NVD; MSRC Security Update Guide — CVE-2026-33824).
NVD's configuration data lists the affected builds across Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) on x86/x64/ARM64, and Windows Server (2016, 2019, 2022, 2022 23H2, 2025) — effectively the full set of Microsoft-supported Windows client and server releases at time of disclosure, each paired with its own fixed cumulative-update build number in NVD's CPE match data (NVD).
Palo Alto Networks' Unit 42 research on an autonomous-AI-assisted intrusion campaign lists CVE-2026-33824 (CVSS 9.8, Windows IKE VPN) among seven CVEs for which a Chinese-speaking threat actor — tracked under the aliases "knaithe" and "KnYuan," based in Zhuhai, China — maintained active exploit tooling, and documents "active exploitation, reverse shell attempts" by this actor against three IKE VPN endpoints as part of their manually operated campaign activity (Unit 42 — Autonomous AI Cyber Attack Campaign).
CISA added CVE-2026-33824 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-18, with a required-action due date of 2026-08-21 under Binding Operational Directive 26-04, and lists known ransomware campaign use as "Unknown" (catalog confirmed live this run, matched by exact cveID string against the raw KEV feed) (CISA KEV).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.7705 (99.55th percentile) — among the highest EPSS scores on this site, consistent with confirmed, ongoing exploitation of an unauthenticated, network-reachable code-execution flaw (FIRST EPSS).
Any Windows host exposing the IKE/IPsec VPN service (client or server) should be patched to the fixed cumulative-update build for its specific version immediately, and hosts that cannot be patched promptly should have IKE/IPsec VPN exposure restricted to trusted networks.
Evidence
- Double free in the Windows IKE Extension allows an unauthorized attacker to execute code over a network. — NVD
- CVSS v3.1 score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, submitted by Microsoft ([email protected]) as a CNA Secondary score; NVD has not published its own Primary metric; MSRC's advisory page is a JavaScript single-page app that returned no static content this run. — NVD
- Affects Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server (2016, 2019, 2022, 2022 23H2, 2025) across listed architectures, each with its own fixed build. — NVD
- A Chinese-speaking threat actor ("knaithe"/"KnYuan," Zhuhai, China) maintained active exploit tooling for CVE-2026-33824 and conducted active exploitation with reverse-shell attempts against three IKE VPN endpoints. — Unit 42 — Autonomous AI Cyber Attack Campaign
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-18, due date 2026-08-21, known ransomware campaign use listed as Unknown; confirmed present in the live KEV feed by exact cveID match this run. — CISA KEV
- EPSS score is 0.7705 (99.55th percentile) as of 2026-10-29. — FIRST EPSS