All vulnerabilities
CVE-2026-33824

Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

Microsoft Internet Key Exchange (IKE) Service ExtensionsApplications & CMS
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationExploited in the wildAdded to KEV 18 Aug 2026CISA KEV
Exploit odds (EPSS)1.62%Chance of exploitation activity in the next 30 days, higher than 75% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.0.14393.9060Also 10.0.17763.8644, 10.0.19044.7184 and 8 moreCVE List
Federal deadline21 Aug 2026Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV

What fixes it

  • 10.0.14393.9060Windows 10 Version 1607CVE List
  • 10.0.17763.8644Windows 10 Version 1809CVE List
  • 10.0.19044.7184Windows 10 Version 21H2CVE List
  • 10.0.19045.7184Windows 10 Version 22H2CVE List
  • 10.0.22631.6936Windows 11 version 23H2CVE List
  • 10.0.22631.6936Windows 11 Version 23H2CVE List
Show all 17 fixed versions
  • 10.0.26100.8246Windows 11 Version 24H2CVE List
  • 10.0.26200.8246Windows 11 Version 25H2CVE List
  • 10.0.28000.1836Windows 11 version 26H1CVE List
  • 10.0.14393.9060Windows Server 2016CVE List
  • 10.0.14393.9060Windows Server 2016 (Server Core installation)CVE List
  • 10.0.17763.8644Windows Server 2019CVE List
  • 10.0.17763.8644Windows Server 2019 (Server Core installation)CVE List
  • 10.0.20348.5020Windows Server 2022CVE List
  • 10.0.25398.2274Windows Server 2022, 23H2 Edition (Server Core installation)CVE List
  • 10.0.26100.32690Windows Server 2025CVE List
  • 10.0.26100.32690Windows Server 2025 (Server Core installation)CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 14 Apr 2026, 16:58 UTCPublishedCVE List
  2. 18 Aug 2026Added to CISA KEVCISA KEV

Description

Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.

Text from CVE List

Affected versions 17

  • Windows 10 Version 1607affected: 10.0.14393.0 before 10.0.14393.9060CVE List
  • Windows 10 Version 1809affected: 10.0.17763.0 before 10.0.17763.8644CVE List
  • Windows 10 Version 21H2affected: 10.0.19044.0 before 10.0.19044.7184CVE List
  • Windows 10 Version 22H2affected: 10.0.19045.0 before 10.0.19045.7184CVE List
  • Windows 11 version 23H2affected: 10.0.22631.0 before 10.0.22631.6936CVE List
  • Windows 11 Version 23H2affected: 10.0.22631.0 before 10.0.22631.6936CVE List
  • Windows 11 Version 24H2affected: 10.0.26100.0 before 10.0.26100.8246CVE List
  • Windows 11 Version 25H2affected: 10.0.26200.0 before 10.0.26200.8246CVE List
  • Windows 11 version 26H1affected: 10.0.28000.0 before 10.0.28000.1836CVE List
  • Windows Server 2016affected: 10.0.14393.0 before 10.0.14393.9060CVE List
  • Windows Server 2016 (Server Core installation)affected: 10.0.14393.0 before 10.0.14393.9060CVE List
  • Windows Server 2019affected: 10.0.17763.0 before 10.0.17763.8644CVE List
  • Windows Server 2019 (Server Core installation)affected: 10.0.17763.0 before 10.0.17763.8644CVE List
  • Windows Server 2022affected: 10.0.20348.0 before 10.0.20348.5020CVE List
  • Windows Server 2022, 23H2 Edition (Server Core installation)affected: 10.0.25398.0 before 10.0.25398.2274CVE List
  • Windows Server 2025affected: 10.0.26100.0 before 10.0.26100.32690CVE List
  • Windows Server 2025 (Server Core installation)affected: 10.0.26100.0 before 10.0.26100.32690CVE List

References 5