CISA flags Windows IKE remote code execution flaw as actively exploited

CISA has added a Windows flaw to its Known Exploited Vulnerabilities list, the catalog reserved for bugs that attackers are actively using in the real world. The entry is CVE-2026-33824, a remote code execution problem in the Windows Internet Key Exchange service extension. That is the component behind IPsec VPN connections.

Security vendor IONIX describes the flaw as a double-free memory issue that a remote attacker can trigger without authentication. In plain words, someone can send crafted network traffic to a vulnerable Windows machine and run code on it without a valid login. Microsoft classifies it as remote code execution.

This matters more than a single patch. IPsec runs on VPN servers, gateways, and the devices that connect branch offices. On many Windows machines the IKE service is present by default, even when the owner never configures a VPN. A flaw here turns a networking service that is often reachable from the internet into an entry point. CISA adds a bug to its KEV catalog when there is evidence of active exploitation, and it sets a deadline for federal agencies to fix it. That deadline is what moves this from routine to urgent.

What to do

• Apply Microsoft's security update now, not at the next patch cycle.
• Check whether the IKE service is running on machines that do not need it.
• Treat internet-facing IPsec endpoints as your highest priority.

For most people the decision is simple. If you run Windows servers or workstations with the IKE service enabled, apply the fix now. The first priority is anyone exposing an IPsec VPN endpoint directly to the internet.

If you do not run a VPN server or use Windows IPsec, this specific flaw is unlikely to touch you directly. It still matters as a reminder: a service people forget about can become a door. The useful habit is not memorizing every CVE. It is knowing which services on your network are reachable from the outside and keeping that list short.

Microsoft has published guidance and a fix. CISA has set a remediation deadline. I will watch for public exploit details, because an unauthenticated remote code execution in a VPN component is the kind of flaw worth treating as urgent.

Sources

• www.ionix.io
• socradar.io
• app.opencve.io

Cover photo by panumas nikhomkhai on Pexels, used under the Pexels License.