[KEV] CVE-2026-33824 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-33824 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-33824 is a double free vulnerability in Microsoft Internet Key Exchange (IKE) Service Extensions that may allow remote code execution through the IKE service attack surface.

Technical Detail

The vulnerability arises from incorrect memory management that can cause the IKE Service Extensions component to free the same memory allocation more than once. An attacker may be able to trigger the condition by sending crafted data handled by the affected IKE service, although the specific triggering sequence has not been publicly confirmed in the available data. Successful exploitation could result in remote code execution in the security context of the affected service.

Exploitation Status

CISA has confirmed active exploitation in the wild. Exploit maturity is assessed as operational, indicating that a usable exploit capability is available and can be employed in real-world intrusion activity rather than existing only as a proof of concept.

Who Is Targeting This

No specific threat actor attribution at this time.

What To Do

Prioritize deployment of Microsoft security updates addressing CVE-2026-33824 on systems running Internet Key Exchange (IKE) Service Extensions. CISA added this vulnerability to the Known Exploited Vulnerabilities Catalog on August 18, 2026; federal civilian executive branch agencies should patch by the CISA-specified due date or apply mitigations, although the specific remediation deadline is not provided in the available data. Where immediate patching is not possible, restrict exposure to the IKE service to trusted networks and peers, and disable unnecessary IKE or IPsec functionality after assessing operational impact. Monitor for unexpected IKE service crashes or restarts, abnormal inbound IKE traffic, and suspicious activity associated with UDP ports 500 and 4500.