🔥 This vulnerability is being actively exploited in the wild (CISA Known Exploited Vulnerabilities catalog)
CVE-2026-33824: Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
Summary
Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability (a memory safety bug where the same memory block is released twice, allowing attackers to execute arbitrary code), which could allow remote code execution (running malicious commands on a victim's computer without permission). This vulnerability is currently being exploited by attackers in the wild. Organizations must apply vendor-provided mitigations by August 21, 2026, following CISA's BOD 26-04 patching guidelines, or stop using the product if no fix is available.
Solution / Mitigation
Apply mitigations in accordance with Microsoft vendor instructions, following CISA's BOD 26-04 Prioritizing Security Updates Based on Risk guidance. For cloud services, apply applicable BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable. Refer to the Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-33824.
Vulnerability Details
EPSS: 55.9%
Yes
🔥 Actively Exploited
August 17, 2026
Classification
Taxonomy References
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-33824
First tracked: August 18, 2026 at 02:01 PM
Classified by LLM (prompt v3) · confidence: 95%