← News
/DISPATCH · 2026-08-20

CVE-2026-33824 Windows IKE Double-Free Unauthenticated RCE, CVSS 9.8, EPSS 99.0 Percentile, Added to CISA KEV

CISA on 18 August added Windows IKE Service Extensions double-free RCE CVE-2026-33824 to the Known Exploited Vulnerabilities catalog. CVSS 9.8, EPSS 99.0 percentile (56% 30-day exploitation probability). Federal agencies must patch by 21 August. Unauthenticated RCE against IPsec VPN servers and Windows IPsec policy endpoints via UDP 500/4500.

CISA on 18 August 2026 added the Windows IKE Service Extensions double-free remote code execution vulnerability CVE-2026-33824 to the Known Exploited Vulnerabilities (KEV) catalog, with a mandatory patch deadline of 21 August for federal civilian agencies. CVSS v3.1 score 9.8 Critical; EPSS entered the 99.0 percentile (56% 30-day exploitation probability). An attacker sending malformed IKE packets to IPsec VPN gateways or Windows IPsec policy endpoints listening on UDP 500/4500 gets unauthenticated RCE. This is the only high-severity IPsec entry among CISA's four same-day KEV listings that had not been patched before this month's Patch Tuesday. Attack surface is more generic than macOS Screen Sharing or SharePoint servers: every Windows host and VPN endpoint with IPsec policy enabled.

Incident Overview

Windows IKE Service Extensions (IKEv2 protocol implementation and IPsec policy registration) is the shared core module for the built-in Windows VPN client, Always On VPN, DirectAccess, Windows Server Routing and Remote Access Service (RRAS), and third-party Windows IPsec policy engines. CVE-2026-33824 is a standard double-free (CWE-415): while handling a specific IKEv2 negotiation exchange's extension payload, the IKE module erroneously returns the same memory block to the free path twice, giving a remote attacker a process-level primitive to rewrite arbitrary code paths and execute arbitrary code in SYSTEM context. The 56% EPSS probability is a key KEV-inclusion factor and keeps it near the top of FIRST.org's most-likely-to-be-weaponized list.

Microsoft shipped a revision attempt in the April Patch Tuesday, but around 10 August independent labs including Watchtower and HN Security confirmed the patch did not fully eliminate the double-free condition. A new wave of exploitation was circulating as PoCs on multiple underground forums before CISA KEV listing. Public research notes at least two actors, claimed Chinese-sphere and Russian-sphere, concurrently refining toolchains. Palo Alto Unit 42 further disclosed a Chinese-sphere APT using DeepSeek-class models as autonomous agents plus human review in parallel development, already treating this vuln as an operational tool. Even though the 21 August federal deadline primarily binds FCEB agencies, private enterprises should rank patching against a 48-hour weaponization window. CISA stresses that blocking UDP 500/4500 only shrinks the external attack surface; internal lateral movement still lets an established attacker chain-hit every unpatched Windows IPsec endpoint on the same segment in 60–90 seconds.

Technical Details

Impact Assessment

IKE/IPsec has long been treated as Windows' most trusted network-layer primitive. Many zero-trust designs lean on IPsec for network-policy isolation before SDP/ZTNA lands. CVE-2026-33824's meaning: once an unauthenticated attacker remotely obtains SYSTEM execution in the IKE process, IPsec policy no longer protects the host—it becomes the weaponization channel. In four typical deployments—branch VPN, hybrid-work endpoints, cross-cloud site-to-site tunnels, industrial OT border gateways—if any endpoint has IPsec policy active, one packet to UDP 500/4500 yields a SYSTEM shell on that endpoint. The enterprise model IPsec tunnel = trust domain becomes IPsec tunnel = attack entry from that moment.

EPSS 99.0 percentile also means the cost of delay, not of remediation: PoC public to ransomware onboarding is typically a 7–14 day window. CISA KEV's 21 August deadline means close the door in 4 days. Same window also holds same-day CVE-2026-65400 (macOS Screen Sharing), CVE-2026-55040 (SharePoint auth bypass), and CVE-2026-59310 (vCenter path traversal). Combined with Palo Alto Unit 42's report that a DeepSeek-assisted Chinese APT simultaneously added CVE-2026-33824 to its exploit library, this is among the first named 2026 samples of AI-accelerated vuln research plus concurrent autonomous exploitation appearing in the Chinese sphere.

Remediation

References