Active Exploitation of Windows IKE Extension RCE (CVE-2026-33824)

A critical vulnerability in the Windows IKE Extension (CVE-2026-33824) allows attackers to execute arbitrary code with SYSTEM privileges on unpatched Windows machines. This is achieved by sending specially crafted UDP packets to the vulnerable system. No authentication or user interaction is required for the attack to succeed.

The attack begins with the attacker identifying a Windows host that accepts IKEv2 traffic on UDP ports 500 or 4500. The attacker then sends a malicious IKEv2 packet, which triggers a double free error in the IKE Extension. This memory corruption allows the attacker to execute arbitrary code with SYSTEM privileges, which can lead to a range of malicious activities, including installing malware, stealing credentials, scanning the internal network, and moving laterally within the network.

The vulnerability affects systems that have IKEv2 enabled and are unpatched. Devices or host defenses that block the crafted packets will prevent the attack from succeeding. Patches released in April 2026 or later will protect against the vulnerability.

When the attack is successful, attackers can run arbitrary code as SYSTEM, enabling them to carry out various malicious activities. There are no user prompts or indications of the attack, and users may simply experience VPN/IKE errors or service crashes. Suspicious IKEv2 traffic, IKEEXT crashes, and the creation of a new SYSTEM-level process shortly after an IKEEXT event are indicators of a successful attack.

To mitigate the risk of exploitation, users should ensure their systems are up-to-date with the latest patches, block unnecessary ports, and restrict IKE traffic to known peers only. Additionally, monitoring for strange IKEv2 traffic, IKEEXT crashes, and SYSTEM-level process creation can help detect and respond to potential attacks.