peter bassill · operator
$ cve CVE-2026-33824 JSON

CVE-2026-33824 KEV

9.8
CRITICAL · CVSS 3.1 · EPSS 1.6% (pctl 75)

Patch first

On CISA KEV — known exploited in the wild, due 2026-08-21.

Description

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS1.62% — more likely to be exploited than 75% of all CVEs
WeaknessCWE-415
On CISA KEVyes — remediate by 2026-08-21
Public exploitnone known
Published2026-04-14
Last modified2026-09-25

CISA KEV

NameMicrosoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
Added2026-08-18
Due2026-08-21
Vendor / productMicrosoft / Internet Key Exchange (IKE) Service Extensions
Ransomware usenone reported

Affected (13)

VendorProduct
microsoftwindows 10 1607
microsoftwindows 10 1809
microsoftwindows 10 21h2
microsoftwindows 10 22h2
microsoftwindows 11 23h2
microsoftwindows 11 24h2
microsoftwindows 11 25h2
microsoftwindows 11 26h1
microsoftwindows server 2016
microsoftwindows server 2019
microsoftwindows server 2022
microsoftwindows server 2022 23h2
microsoftwindows server 2025

References

→ the Explorer  ·  watch your stack  ·  NVD