New Microsoft IKE Vulnerability CVE-2026-33824: SMB Action Plan

A newly exploited vulnerability in Microsoft's IKE Service Extensions affects SMBs using IPsec. Here's what to do now.

The short version

CVE-2026-33824 is a memory management vulnerability in Microsoft IKE Service Extensions.
It can be exploited remotely and has been seen in active attacks.
SMBs should apply Microsoft’s patch and check for IKE Service Extension updates.
Darksteel can help assess and secure your systems from this and other threats.

What is CVE-2026-33824?

CVE-2026-33824 is a vulnerability in Microsoft’s Internet Key Exchange (IKE) Service Extensions. Specifically, it’s a 'double free' issue, meaning the software tries to free a block of memory twice. This can lead to unpredictable behavior, including potential code execution if an attacker sends specially crafted data to the affected system.

The vulnerability is part of Microsoft’s IPsec implementation, which is used to secure network communications. Because it can be triggered remotely, there’s no need for a user to click on anything or interact directly with the system. This makes it a serious risk for any SMB using IPsec-based services like remote access or site-to-site connections.

Does this affect my SMB?

If your SMB uses Microsoft systems that support IPsec—such as Windows servers or devices running IKE Service Extensions—you are at risk. This includes systems used for secure remote access, like virtual private networks (VPNs), or for connecting to other networks securely.

Most SMBs have at least some IPsec-based infrastructure, especially if you allow remote access for employees or contractors. Because this vulnerability can be triggered without user interaction, it's important to understand your exposure and act quickly.

What should I do this week?

First, apply the patch that Microsoft released to address CVE-2026-33824. Microsoft typically delivers these updates through its regular patching cycle. Ensure that your systems are updated and that the patch for IKE Service Extensions is applied.

Second, review your network to identify all systems that use IKE Service Extensions. This includes servers, network devices, and any hardware or software that handles IPsec connections. Make sure each of these is patched.

Third, monitor your network for unusual behavior. Look for unexpected connections, strange login attempts, or other anomalies. If you detect anything suspicious, isolate the affected systems and seek expert help.

How do I know if I was already hit?

It can be difficult to determine if your systems have already been compromised, especially if an attacker has taken steps to hide their activities. However, there are some signs to look for, such as unexpected network traffic, unusual login attempts, or system logs showing activity around the time the vulnerability was first reported (August 18, 2026).

Check your system logs for any anomalies, especially if you have IPsec services exposed to the internet. If you're unsure or find something concerning, consider engaging a cybersecurity expert to perform a deeper investigation.

Not sure whether your environment is exposed? That is exactly what our Vulnerability Management service is built to surface. Talk to us.

Frequently asked questions

What is the IKE Service Extension?

The Internet Key Exchange (IKE) Service Extension is part of Microsoft’s IPsec implementation. It helps establish secure connections between devices, such as when setting up a virtual private network (VPN).

Is there a known ransomware group using this vulnerability?

As of now, there is no known ransomware group that has been confirmed to be using CVE-2026-33824. However, the fact that it's being exploited in the wild means it's a real and present threat.

What if I can't patch immediately?

If you're unable to apply the patch right away, consider implementing network segmentation to limit exposure. This can help contain the damage if an attacker does exploit the vulnerability.

Can this vulnerability be exploited without user interaction?

Yes, CVE-2026-33824 can be triggered remotely without any user interaction. This makes it particularly dangerous, as an attacker only needs to connect to an affected system to potentially exploit it.

Source (public domain): CISA