CVE-2026-33824 is a critical remote code execution vulnerability in the Windows IKE Extension (MS-IKEE), a component that enhances the IKE protocol with features such as cryptographically generated address authentication and denial-of-service protection. The vulnerability is caused by a double free condition that allows unauthenticated attackers to execute arbitrary code remotely by sending malicious packets to UDP ports 500 or 4500 on affected systems. Microsoft addressed this flaw in the April 2026 Patch Tuesday release. Despite Microsoft not yet marking it as exploited, CISA has confirmed active exploitation in the wild and issued binding directives for federal agencies to patch or mitigate the vulnerability within three days. Mitigations include patching or firewall rules to block or restrict UDP traffic related to IKE. The flaw affects all supported versions of Windows 10, Windows 11, and Windows Server.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on vulnerable Windows systems, potentially leading to full system compromise. The vulnerability is actively exploited in the wild, increasing the risk to affected organizations. It affects all supported Windows 10, Windows 11, and Windows Server versions with IKEv2 enabled. The critical severity and active exploitation status indicate a high risk of compromise if unpatched.

Microsoft released an official security update in April 2026 that fixes this vulnerability. Organizations should apply this patch immediately. For systems where patching cannot be done promptly, Microsoft recommends blocking inbound UDP traffic on ports 500 and 4500 if IKE is not used, or configuring firewall rules to allow inbound traffic only from known peer addresses when IKE is in use. CISA mandates U.S. federal agencies to remediate within three days and urges all network defenders to prioritize patching to block ongoing attacks.