CVE-2026-33824: Microsoft IKE Service Extensions Double Free Actively Exploited — Detection, Hunting, and Remediation Guide

On August 18, 2026, CISA added CVE-2026-33824 to the Known Exploited Vulnerabilities (KEV) catalog, confirming what many of us in IR have been bracing for: a double free vulnerability in Microsoft's Internet Key Exchange (IKE) Service Extensions is being actively exploited in the wild. The flaw enables unauthenticated remote code execution against systems running the IKE and AuthIP IPsec Keying Modules service (IKEEXT) — the very service that brokers IPsec VPN tunnels, site-to-site connectivity, and Always On VPN for many enterprises.

This is not a theoretical memory-corruption bug. KEV inclusion means threat actors have working exploitation and are using it operationally. Because IKEEXT listens on the network perimeter of VPN gateways and RRAS servers, a successful exploit lands an attacker on infrastructure that, by design, sits at the trust boundary of your network. Under CISA BOD 26-04 and the accompanying Forensics Triage Requirements, federal agencies — and every private-sector organization that treats KEV as a patch-priority signal — must apply vendor mitigations immediately or discontinue use of the affected component.

Technical Analysis

What Is Affected

The vulnerable component is the IKE and AuthIP IPsec Keying Modules service (IKEEXT), hosted inside a svchost.exe process group on Windows systems. Systems at highest risk include:

• Windows Server systems acting as IPsec VPN gateways or running Routing and Remote Access Service (RRAS)
• Servers terminating Always On VPN (device/user tunnels over IKEv2)
• Domain-joined systems enforcing connection security rules / IPsec policies via Group Policy
• Any Windows host where the IKEEXT service is running and reachable on UDP 500 (IKE) and UDP 4500 (NAT-T), plus IP protocol 50/51 (ESP/AH) in tunnel-mode deployments

Microsoft's advisory covers supported Windows client and server releases with the service enabled. Consult the Microsoft Security Response Center (MSRC) advisory for CVE-2026-33824 for the exact build matrix; the August 2026 cumulative updates carry the fix.

How the Vulnerability Works (Defender's View)

A double free occurs when a program calls free() (or the Windows heap equivalent, HeapFree/RtlpFreeHeap) twice on the same memory allocation. The heap allocator's metadata becomes corrupted, and under controlled conditions an attacker can coerce the allocator into returning overlapping or attacker-influenced allocations — a classic path to arbitrary write primitives and, ultimately, code execution.

From a defender's perspective, the attack chain looks like this:

1. Reconnaissance: The attacker scans for hosts listening on UDP 500/4500 — VPN concentrators and RRAS servers are trivially fingerprintable by their IKE responses.
2. Trigger: Specially crafted IKEv2 (or AuthIP) negotiation packets are sent to the IKEEXT service. No authentication is required — the vulnerable parsing path executes before any tunnel is established, during the SA negotiation phase.
3. Heap corruption: The malformed exchange causes IKEEXT to free the same chunk twice, corrupting the NT heap within the hosting svchost.exe process.
4. Execution: The attacker achieves code execution in the security context of the service — typically SYSTEM or NetworkService with elevated privileges — on the VPN gateway itself.
5. Post-exploitation: From a VPN gateway, expect credential theft (cached domain/machine credentials), traffic interception, tampering with IPsec policies, and lateral movement into the internal network the gateway was protecting.

Exploitation Status

• CISA KEV: Added 2026-08-18 — confirmed active exploitation
• Authentication required: None
• Exposure surface: Network-reachable, pre-authentication
• CISA directive: BOD 26-04 requires remediation per vendor instructions, compliance with CISA's Forensics Triage Requirements, and discontinuation of the product if mitigations cannot be applied

Any internet-facing or partner-facing IPsec endpoint running an unpatched IKEEXT service should be treated as potentially compromised, not merely vulnerable. Given pre-auth RCE on a boundary device, assume-breach triage is warranted on exposed assets.

Detection & Response

Double-free exploitation against a service like IKEEXT rarely leaves clean IOCs, but it leaves behavioral fingerprints: service instability and crashes in the IKEEXT-hosting svchost, post-exploitation process execution descending from that service host, and anomalous IKE negotiation volumes. The detections below target those fingerprints.

Sigma Rules

---
title: IKEEXT Service Crash or Unexpected Termination
tid: 6f2c1a94-3b7d-4e58-9c21-8a4f5d6b7e90
status: experimental
description: Detects crash or unexpected termination of the IKE and AuthIP IPsec Keying Modules (IKEEXT) service, a potential indicator of double-free exploitation attempts against CVE-2026-33824.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-33824
author: Security Arsenal
date: 2026/08/18
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  product: windows
  service: system
detection:
  selection_provider:
    Provider_Name: 'Service Control Manager'
  selection_event:
    EventID:
      - 7031
      - 7034
  selection_service:
    - 'IKEEXT'
    - 'IKE and AuthIP IPsec Keying Modules'
  condition: selection_provider and selection_event and selection_service
falsepositives:
  - Legitimate service instability from driver conflicts or failed updates
level: high
---
title: Suspicious Child Process Spawned by IKEEXT Service Host
tid: 3d8e5b16-9a2f-4c47-b83e-5f1a2c6d9e04
status: experimental
description: Detects command shells, script interpreters, or LOLBins spawned by the svchost instance hosting the IKEEXT service, consistent with post-exploitation activity following unauthenticated code execution via CVE-2026-33824.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-33824
author: Security Arsenal
date: 2026/08/18
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\svchost.exe'
    ParentCommandLine|contains: 'ikeext'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\nltest.exe'
      - '\whoami.exe'
  condition: selection_parent and selection_child
falsepositives:
  - None expected under normal operations; IKEEXT does not legitimately spawn interactive tooling
level: critical
---
title: Anomalous Inbound IKE Negotiation Burst
tid: a14b7c52-6e9d-4f38-91a6-2c8b5e7d3f01
status: experimental
description: Detects a high volume of IKE (UDP 500/4500) negotiation attempts from a single external source against Windows hosts, potentially indicating exploitation probing or heap-grooming traffic associated with CVE-2026-33824.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-33824
author: Security Arsenal
date: 2026/08/18
tags:
  - attack.initial_access
  - attack.t1190
  - attack.discovery
  - attack.t1046
logsource:
  category: firewall
  product: windows
detection:
  selection:
    DestinationPort:
      - 500
      - 4500
    Protocol: 'udp'
    Action: 'allow'
  condition: selection
falsepositives:
  - Legitimate site-to-site VPN renegotiation; baseline peer gateways and exclude known tunnel endpoints
level: medium

The second rule is your highest-fidelity signal. IKEEXT legitimately spawns almost nothing — a svchost -k ikeext parenting cmd.exe or powershell.exe on a VPN gateway is effectively a smoke alarm, not a noise source. Tune rule three against your known tunnel peers; it exists to catch the spray-and-pray heap-grooming phase from unfamiliar sources.

KQL — Microsoft Sentinel / Defender

// Hunt 1: IKEEXT service crashes and unexpected terminations (potential exploitation attempts)
SecurityEvent
| where TimeGenerated > ago(14d)
| where EventID in (7031, 7034)
| where EventData has "IKEEXT" or EventData has "IKE and AuthIP IPsec Keying Modules"
| summarize CrashCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, bin(TimeGenerated, 1h)
| where CrashCount >= 2
| sort by LastSeen desc;

// Hunt 2: Post-exploitation process execution under the IKEEXT service host
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "svchost.exe"
| where InitiatingProcessCommandLine has "ikeext"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","wmic.exe","certutil.exe","bitsadmin.exe","net.exe","whoami.exe","nltest.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName, SHA256
| sort by TimeGenerated desc;

// Hunt 3: External IKE probing against VPN endpoints (via firewall/Syslog ingestion)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort in (500, 4500)
| where Protocol =~ "udp"
| where DeviceAction in ("allow", "permit", "Accept")
| summarize ConnectionCount = count(), DistinctDestinations = dcount(DestinationIP) by SourceIP, bin(TimeGenerated, 15m)
| where ConnectionCount > 100
| sort by ConnectionCount desc;

Velociraptor VQL

-- Hunt: IKEEXT service health, service-host children, and IKE listeners
-- Deploy as a notebook or hunt across VPN gateways / RRAS servers

-- 1. Identify the svchost instance hosting IKEEXT and any child processes
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'ikeext'
   OR Name =~ '(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin)\.exe'

-- 2. Confirm which hosts are actually exposing IKE listeners
SELECT Pid, Name, Family, Type, Laddr, Lport, Raddr, Rport, Status
FROM netstat()
WHERE Lport in (500, 4500)

-- 3. Pull Windows Error Reporting artifacts for svchost/IKEEXT crash evidence
SELECT FullPath, Size, Mtime
FROM glob(globs='C:/ProgramData/Microsoft/Windows/WER/ReportQueue/**/*')
WHERE FullPath =~ 'svchost' OR FullPath =~ 'IKEEXT'
ORDER BY Mtime DESC

The third VQL query deserves emphasis: double-free exploitation is rarely reliable on the first attempt. Expect crash artifacts from failed exploitation to precede a successful compromise — WER reports referencing the IKEEXT-hosting svchost are your early-warning tripwire and belong in the forensic triage package CISA's requirements demand.

Verification & Hardening Script

# CVE-2026-33824 — IKEEXT exposure assessment and patch verification
# Run elevated on VPN gateways, RRAS servers, and IPsec-enforced hosts

# 1. Determine whether IKEEXT is running (i.e., whether this host is exposed)
$svc = Get-Service -Name IKEEXT -ErrorAction SilentlyContinue
if ($svc -and $svc.Status -eq 'Running') {
    Write-Host "[!] IKEEXT is RUNNING on $env:COMPUTERNAME — host is in scope for CVE-2026-33824" -ForegroundColor Red
} else {
    Write-Host "[+] IKEEXT is not running ($($svc.Status))" -ForegroundColor Green
}

# 2. Verify the August 2026 cumulative update (or later) is installed
#    Confirm the applicable KB against the MSRC advisory for CVE-2026-33824
$osBuild = [System.Environment]::OSVersion.Version
Write-Host "[*] OS Build: $($osBuild.ToString())"
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID, InstalledOn | Format-Table

# 3. Enumerate installed IPsec connection security rules (attack surface inventory)
Get-NetIPsecRule -PolicyStore ActiveStore -ErrorAction SilentlyContinue |
  Where-Object {$_.Enabled -eq 'True'} |
  Select-Object DisplayName, Profile, InboundSecurity, OutboundSecurity | Format-Table -AutoSize

# 4. Check for recent IKEEXT crash evidence (last 14 days)
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7031,7034; StartTime=(Get-Date).AddDays(-14)} -ErrorAction SilentlyContinue |
  Where-Object {$_.Message -match 'IKEEXT|IKE and AuthIP'} |
  Select-Object TimeCreated, Id, Message | Format-List

# 5. Emergency compensating control ONLY if patching is impossible:
#    Restrict IKE to known tunnel peers at the host firewall (breaks dynamic/road-warrior VPN)
# New-NetFirewallRule -DisplayName "IKE-Restrict-KnownPeers" -Direction Inbound -Protocol UDP -LocalPort 500,4500 -RemoteAddress <trusted_peer_CIDRs> -Action Allow
# New-NetFirewallRule -DisplayName "IKE-Block-AllOther" -Direction Inbound -Protocol UDP -LocalPort 500,4500 -Action Block

# 6. If the service is not required on this host (not a VPN gateway, no IPsec policy):
#    Disable it to remove the attack surface entirely
# Set-Service -Name IKEEXT -StartupType Disabled; Stop-Service -Name IKEEXT -Force

Remediation

1. Patch immediately. Apply the August 2026 (or later) Microsoft cumulative update that resolves CVE-2026-33824 to every Windows system running the IKEEXT service, prioritizing internet-facing VPN gateways, RRAS servers, and Always On VPN infrastructure. Pull the exact KB for your OS build from the MSRC advisory for CVE-2026-33824 and verify installation with the script above.

2. Meet the CISA KEV deadline. KEV entries carry a due date under BOD 26-04 — check the catalog entry for the mandated remediation date. CISA's required action is explicit: apply vendor mitigations, comply with BOD 26-04 risk-based prioritization and the Forensics Triage Requirements, follow applicable guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Treat the KEV due date as the outer bound, not the target — active exploitation means your real deadline is now.

3. Assume breach on exposed assets. Any IKEEXT host reachable from untrusted networks during the exploitation window requires forensic triage: collect WER crash artifacts, memory from the IKEEXT svchost, Security/System event logs, and EDR telemetry covering the exposure period. Preserve this evidence per CISA's Forensics Triage Requirements before rebuilding if compromise indicators surface.

4. Reduce the attack surface. Disable IKEEXT on systems that are not VPN endpoints and have no active IPsec policy (step 6 of the script). Audit Group Policy for unnecessary connection security rules that silently enable the service across your fleet.

5. Compensating controls where patching is delayed. Restrict UDP 500/4500 at the perimeter and host firewall to known tunnel peer addresses only. Understand the tradeoff: this breaks remote-access VPN models with dynamic client addresses — for those, accelerated patching is the only safe path.

6. Deploy the detections above to your SIEM/EDR now, and set alerting on IKEEXT service crashes as a high-severity event. A crashed VPN service on a perimeter device is never "just instability" in an active-exploitation window.

7. Hunt backward. Query at least 30 days of telemetry for child processes of the IKEEXT svchost and crash patterns. Double-free exploits are probabilistic — a successful intrusion may be preceded by weeks of visible crash noise.

Boundary devices with pre-authentication RCE are how intrusions become breaches. The organizations that patch the gateway and triage it for prior compromise in the same change window are the ones that don't end up calling an IR firm at 2 a.m.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub