CISA has added CVE-2026-33824 to its Known Exploited Vulnerabilities catalog and given US federal civilian agencies three days to patch it. The flaw lives in Windows Internet Key Exchange (IKE) Extension — a Microsoft-added layer on top of the IKE protocol that handles things like cryptographically-generated-address authentication and interoperability with non-IPsec peers. An attacker who can reach UDP ports 500 or 4500 on an unpatched Windows machine can send specially crafted packets and gain remote code execution without any credentials. Microsoft’s advisory describes it as a “double free” memory corruption bug that allows “an unauthorized attacker to execute code over a network.” The patch shipped as part of April 2026 Patch Tuesday.
The active exploitation confirms attackers are scanning for and hitting unpatched systems. CISA’s Binding Operational Directive 26-04 mandates remediation for federal civilian agencies on a three-day clock, and CISA explicitly called the bug class “a frequent attack vector for malicious cyber actors” that “poses significant risks to the federal enterprise.” For everyone else, the remediation priority is the same: apply the April 2026 Windows cumulative update immediately. If patching cannot happen right away, Microsoft’s advisory offers a firewall workaround — block inbound UDP 500 and 4500 on any system that does not use IKE, or restrict those ports to known peer addresses when IKE is in use.
How to check if you’re affected
Affected versions include all supported Windows 10 and Windows 11 editions and all current Windows Server releases. Open Settings → Windows Update and confirm the April 2026 cumulative update is installed. You can also check winver — the patch brings your build to the version shipped in April 2026. If you manage a fleet, query patch compliance with Microsoft Endpoint Manager or WSUS before the end of the three-day CISA window. Devices that have not applied the April 2026 update are vulnerable regardless of network position; an exposed UDP 500/4500 port is all an attacker needs.