CVE-2026-33824
published 2026-04-14CVE-2026-33824: Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
PriorityP187critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2026-08-21
Exploited in the wild
EPSS
1.62%
75.3th percentile
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1607 | < 10.0.14393.9060 | 10.0.14393.9060 |
| microsoft | windows_10_1809 | < 10.0.17763.8644 | 10.0.17763.8644 |
| microsoft | windows_10_21h2 | < 10.0.19044.7184 | 10.0.19044.7184 |
| microsoft | windows_10_22h2 | < 10.0.19045.7184 | 10.0.19045.7184 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.9060 | 10.0.14393.9060 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.8644 | 10.0.17763.8644 |
| microsoft | windows_10_version_21h2 | >= 10.0.19044.0 < 10.0.19044.7184 | 10.0.19044.7184 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.7184 | 10.0.19045.7184 |
| microsoft | windows_11_23h2 | < 10.0.22631.6936 | 10.0.22631.6936 |
| microsoft | windows_11_24h2 | < 10.0.26100.8246 | 10.0.26100.8246 |
| microsoft | windows_11_25h2 | < 10.0.26200.8246 | 10.0.26200.8246 |
| microsoft | windows_11_26h1 | < 10.0.28000.1836 | 10.0.28000.1836 |
| microsoft | windows_11_version_23h2 | >= 10.0.22631.0 < 10.0.22631.6936 | 10.0.22631.6936 |
| microsoft | windows_11_version_24h2 | >= 10.0.26100.0 < 10.0.26100.8246 | 10.0.26100.8246 |
| microsoft | windows_11_version_25h2 | >= 10.0.26200.0 < 10.0.26200.8246 | 10.0.26200.8246 |
| microsoft | windows_11_version_26h1 | >= 10.0.28000.0 < 10.0.28000.1836 | 10.0.28000.1836 |
| microsoft | windows_server_2016 | < 10.0.14393.9060 | 10.0.14393.9060 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.9060 | 10.0.14393.9060 |
| microsoft | windows_server_2019 | < 10.0.17763.8644 | 10.0.17763.8644 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.8644 | 10.0.17763.8644 |
| microsoft | windows_server_2022 | < 10.0.20348.5020 | 10.0.20348.5020 |
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.5020 | 10.0.20348.5020 |
| microsoft | windows_server_2022_23h2 | < 10.0.25398.2274 | 10.0.25398.2274 |
| microsoft | windows_server_2025 | < 10.0.26100.32690 | 10.0.26100.32690 |
| microsoft | windows_server_2025 | >= 10.0.26100.0 < 10.0.26100.32690 | 10.0.26100.32690 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for anomalous or specially crafted IKEv2 packets sent to Windows hosts with Internet Key Exchange version 2 enabled, as exploitation involves unauthenticated network-based packet delivery to ikeext.dll. ↗
- →Focus detection on the IKE/AuthIP IPsec Keying Modules service (ikeext.dll) for double-free memory corruption indicators, such as unexpected crashes, heap corruption events, or process anomalies in the ikeext service process. ↗
- →Prioritize patching and detection on internet-exposed Windows systems with IKEv2 enabled, given the critical CVSS score of 9.8 and unauthenticated remote code execution potential. ↗
- ·The vulnerability is in the Windows IKE Extension (ikeext.dll) and is only exploitable on machines where IKEv2 is enabled; systems without IKEv2 active are not directly exposed to this attack vector. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q6qf-3m2m-xq4f: Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network
ghsa_unreviewed·2026-04-14
CVE-2026-33824 [CRITICAL] CWE-415 GHSA-q6qf-3m2m-xq4f: Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
VulDB
Microsoft Windows up to Server 2025 IKE Service Extensions double free
vuldb·2026-04-14·CVSS 9.8
CVE-2026-33824 [CRITICAL] Microsoft Windows up to Server 2025 IKE Service Extensions double free
A vulnerability described as very critical has been identified in Microsoft Windows. Affected by this vulnerability is an unknown functionality of the component IKE Service Extensions. Executing a manipulation can lead to double free.
The identification of this vulnerability is CVE-2026-33824. The attack may be launched remotely. There is no exploit available.
Upgrading the affected component is recommended.
VulnCheck
Microsoft Windows Double Free
vulncheck·2026·CVSS 9.8
CVE-2026-33824 [CRITICAL] Microsoft Windows Double Free
Microsoft Windows Double Free
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
Affected: Microsoft Windows
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/
CISA
Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
cisa·2026-08-18·CVSS 9.8
CVE-2026-33824 [CRITICAL] CWE-415 Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
Vulnerability: Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
Affected: Microsoft Internet Key Exchange (IKE) Service Extensions
Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guid
No detection rules found.
No public exploits indexed.
Recorded Future
August 2026 CVE Landscape
blogs_recorded_future·2026-09-08·CVSS 8.8
CVE-2025-62593 [HIGH] August 2026 CVE Landscape
## August 2026 CVE Landscape
In August 2026, Insikt Group® identified 73 high-impact vulnerabilities that should be prioritized for remediation , 43 of which had a Very Critical Recorded Future Risk Score. This represents a 14% decrease from last month. 31 of these vulnerabilities were surfaced through the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, 32 were reported in open sources and validated by Insikt Group, seven were sourced through security vendor telemetry, and three were exclusively surfaced through honeypot data.
The 73 vulnerabilities in this blog affected products from 45 vendors, with Microsoft accounting for approximately 11% of the vulnerabilities. The remaining exposure spanned remote monitoring and managemen
Hackernews
Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
blogs_hackernews·2026-08-19·CVSS 9.8
CVE-2026-65400 [CRITICAL] Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four critical vulnerabilities to its Known Exploited Vulnerabilities ( KEV ) catalog, stating they are being exploited in the wild.
The shortcomings added to the KEV catalog are listed below -
CVE-2026-65400 (CVSS score: 9.8) - An improper authentication vulnerability impacting Apple macOS that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.
CVE-2026-55040 (CVSS score: 9.1) - A weak authentication vulnerab
Tenable
The Agentic AI threat cluster: Seven incidents, three actors, and what they mean for your exposure
blogs_tenable·2026-08-14·CVSS 9.8
CVE-2025-3248 [CRITICAL] The Agentic AI threat cluster: Seven incidents, three actors, and what they mean for your exposure
## The Agentic AI threat cluster: Seven incidents, three actors, and what they mean for your exposure
Tenable’s Research Special Operations (RSO) team has been tracking a cluster of agentic AI threat activity since late July 2026. The Taiwan autonomous AI cyber attack confirmed what the cluster data already showed: near-autonomous offensive AI has crossed from theoretical risk to operational reality.
## Key Takeaways
Taiwan's Ministry of Digital Affairs confirmed a near-autonomous AI cyber attack in July 2026 in which autonomous agents mapped 21 connected government systems, compromised 85 accounts, and exfiltrated more than 2,564 personnel records in approximately four days.
The Taiwan campaign is part of a broader seven-incident agentic AI threat cluster that also includes JADEPUFFER
Hackernews
CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited
blogs_hackernews·2026-08-05·CVSS 7.4
CVE-2026-9198 [HIGH] CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on August 5, 2026, added three flaws to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation in the wild.
The list of vulnerabilities is as follows -
CVE-2026-9198 (CVSS score: 9.8) - A code injection vulnerability in Langflow that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments. (Fixed in July 2026 with version 1.10.1)
CVE-2026-34486 (CVS score: 7.5) - A missing encryption of sensitive data
Unit42
Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
blogs_unit42·2026-07-30
CVE-2026-33017 Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
## Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
Andy Piazza
Published: July 30, 2026
Threat Research
Vulnerabilities
ChatGPT
Claude code
CVEs
DeepSeek
Exploitation
Hermes Agent
## Executive Summary
Unit 42 identified an AI-enabled autonomous hacking campaign carried out by a Chinese-speaking threat actor. They targeted infrastructure using seven vulnerabilities, combining autonomous AI-driven enumeration with manual exploitation that achieved confirmed impact.
The actor, operating under the aliases knaithe and KnYuan , leveraged DeepSeek , via the Hermes Agent framework, as their autonomous offensive operator. They orchestrated this operator via Telegram for the following activities:
Independently enumerating targets and their vulnerabiliti
Hackernews
ThreatsDay: AI-Powered Hacking, 370 Chrome Flaws, SonicWall Attacks, DNS Hijacking + 22 More Stories
blogs_hackernews·2026-07-30
CVE-2026-33017 ThreatsDay: AI-Powered Hacking, 370 Chrome Flaws, SonicWall Attacks, DNS Hijacking + 22 More Stories
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ThreatsDay: AI-Powered Hacking, 370 Chrome Flaws, SonicWall Attacks, DNS Hijacking + 22 More Stories
A lot of security still comes down to trusting the wrong screen.
This week, that screen might be a login page, an install guide, a recruiter call, or a familiar service behaving slightly wrong. Behind it: reused credentials, exposed systems, quiet loaders, abused trust, and exploit paths that should have been harder.
Some defenses improved. The loose parts still got found first. Anyway, here's the mess.
The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.
A cybercrime grou
Hackernews
Microsoft's MDASH AI System Finds 16 Windows Flaws Fixed in Patch Tuesday
blogs_hackernews·2026-05-13
CVE-2026-33824 Microsoft's MDASH AI System Finds 16 Windows Flaws Fixed in Patch Tuesday
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Microsoft's MDASH AI System Finds 16 Windows Flaws Fixed in Patch Tuesday
Microsoft has unveiled a new multi-model artificial intelligence (AI)-driven system called MDASH to facilitate vulnerability discovery and remediation at scale, adding that it's being tested by some customers as part of a limited private preview.
MDASH, short for m ulti-mo d el a gentic s canning h arness, is designed as a model-agnostic system that uses bespoke AI agents for different vulnerability classes to autonomously discover, validate, and prove exploitable defects in complex codebases like Windows.
"Unlike single-model approaches, the harness
Hackernews
⚡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking & More
blogs_hackernews·2026-04-27
CVE-2025-20333 ⚡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking & More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking & More
Everything is dumb again. This week feels broken in a very familiar way. Old tricks are back. New tools are doing shady crap. Supply chains got hit. Fake help desks worked. Weird research showed how easy some attacks still are.
Most of it feels like stuff we should have fixed years ago. Bad extensions. Stolen creds. Remote tools are getting abused. Malware hides in places people trust. Same mess, cleaner packaging.
Coffee is cold. The vuln list is ugly. Let’s get into it.
## ⚡ Threat of the Week
New fast16 Malware Was Developed Y
Hackernews
Microsoft Issues Patches for SharePoint Zero-Day and 168 Other New Vulnerabilities
blogs_hackernews·2026-04-15·CVSS 7.5
[HIGH] Microsoft Issues Patches for SharePoint Zero-Day and 168 Other New Vulnerabilities
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Microsoft Issues Patches for SharePoint Zero-Day and 168 Other New Vulnerabilities
Microsoft on Tuesday released updates to address a record 169 security flaws across its product portfolio, including one vulnerability that has been actively exploited in the wild.
Of these 169 vulnerabilities, 157 are rated Important, eight are rated Critical, three are rated Moderate, and one is rated Low in severity. Ninety-three of the flaws are classified as privilege escalation, followed by 21 information disclosure, 21 remote code execution, 14 security feature bypass, 10 spoofing, and nine denial-of-service vulnerabilities.
Also inclu
Tenable
Microsoft’s April 2026 Patch Tuesday Addresses 163 CVEs (CVE-2026-32201)
blogs_tenable·2026-04-14·CVSS 6.5
[MEDIUM] Microsoft’s April 2026 Patch Tuesday Addresses 163 CVEs (CVE-2026-32201)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days
blogs_bleepingcomputer·2026-04-14·CVSS 6.5
[MEDIUM] Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days
## Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days
## Lawrence Abrams
Today is Microsoft's April 2026 Patch Tuesday with security updates for 167 flaws, including 2 zero-day vulnerabilities.
This Patch Tuesday also addresses eight "Critical" vulnerabilities, 7 of which are remote code execution flaws and the other is a denial of service flaw.
The number of bugs in each vulnerability category is listed below:
93 Elevation of Privilege Vulnerabilities
13 Security Feature Bypass Vulnerabilities
20 Remote Code Execution Vulnerabilities
21 Information Disclosure Vulnerabilities
10 Denial of Service Vulnerabilities
9 Spoofing Vulnerabilities
When BleepingComputer reports on Patch Tuesday security updates, we only count those released by Microsoft today.
Therefore, the
Talos
Microsoft Patch Tuesday for April 2026 - Snort Rule and Prominent Vulnerabilities
blogs_talos·2026-04-14·CVSS 7.5
CVE-2026-23666 [HIGH] Microsoft Patch Tuesday for April 2026 - Snort Rule and Prominent Vulnerabilities
## Microsoft Patch Tuesday for April 2026 - Snort Rule and Prominent Vulnerabilities
Microsoft has released its monthly security update for April 2026, which includes 165 vulnerabilities affecting a wide range of products, including eight Microsoft marked as “critical.”
CVE-2026-23666 is a critical Denial of Service (DoS) vulnerability that affects the .NET framework. Successful exploitation could allow the attacker to deny service over the network.
CVE-2026-32157 is a critical use after free vulnerability in the Remote Desktop Client that results in code execution. Attack requires an authorized user on the client to connect to a malicious server, which could result in code execution on the client.
CVE-2026-32190 is a critical user after free vulnerability in Microsoft Office that can
Qualys
Microsoft and Adobe Patch Tuesday, April 2026 Security Update Review
blogs_qualys·2026-04-14
Microsoft and Adobe Patch Tuesday, April 2026 Security Update Review
## Table of Contents
Microsoft Patch Tuesday forApril2026
Adobe Patches for April2026
Zero-day Vulnerabilities Patched inAprilPatch Tuesday Edition
Critical Severity Vulnerabilities Patched inAprilPatch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Qualys Monthly Webinar Series
April 2026’s Patch Tuesday arrives with Microsoft addressing a fresh set of vulnerabilities across its ecosystem, reinforcing the ongoing need for timely patching in an increasingly threat-heavy landscape. Here’s a quick breakdown of what you need to know.
## Microsoft Patch Tuesday for April 2026
This month’s release addresses 163 vulnerabilities, including eight critical and 154 important-severity vulnerabilities.
In this month’s updates, Microsoft has addressed one
Sans Isc
Microsoft Patch Tuesday April 2026., (Tue, Apr 14th)
blogs_sans_isc·2026-04-14·CVSS 8.8
[HIGH] Microsoft Patch Tuesday April 2026., (Tue, Apr 14th)
Microsoft Patch Tuesday April 2026.
Published: 2026-04-14. Last Updated: 2026-04-14 17:46:09 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)
This month's Microsoft Patch Tuesday looks like a record one, but let's look at it a bit closer to understand what is happening
The update patches a total of 243 vulnerabilities. However, 78 of them are Chromium issues affecting Microsoft Edge. Patches for Edge were released earlier. This leaves 165 vulnerabilities that are not Edge-related. Of these, 8 are rated critical, and 154 are important. One vulnerability has already been exploited, and another was made public before today but has not yet been seen in the wild.
Noteworthy Vulnerabilities:
CVE-2026-33827 (Windows TCP/IP Remote Code Execution Vulnerability): As a packet nerd, I love thes
Rapid7
Patch Tuesday - April 2026
blogs_rapid7·2026-04-14·CVSS 6.5
[MEDIUM] Patch Tuesday - April 2026
Microsoft is publishing 167 vulnerabilities on April 2026 Patch Tuesday . Microsoft is aware of exploitation in the wild for one of today’s vulnerabilities, and public disclosure for one other. Microsoft evaluates 19 of the vulnerabilities published today as more likely to see future exploitation. So far this month, Microsoft has provided patches to address 80 browser vulnerabilities, which are not included in the Patch Tuesday count above.
## Increasing volumes of vulnerabilities
Regular Patch Tuesday watchers will know that these vulnerability totals are significantly higher than usual, especially the browser numbers. Late last week, Microsoft published patches to resolve more than 60 browser vulnerabilities in a single day, which is a new record in that very specific category.
It mig
Crowdstrike
April 2026 Patch Tuesday: Two Zero-Days and Eight Critical Vulnerabilities Among 164 CVEs
blogs_crowdstrike
April 2026 Patch Tuesday: Two Zero-Days and Eight Critical Vulnerabilities Among 164 CVEs
April 2026 Patch Tuesday: Two Zero-Days and Eight Critical Vulnerabilities Among 164 CVEs Apr 14, 2026
Anthropic Claude Mythos Preview: The More Capable AI Becomes, the More Security It Needs Apr 06, 2026
How CrowdStrike Is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 05, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
April 2026 Patch Tuesday: Two Zero-Days and Eight Critical Vulnerabilities Among 164 CVEs Apr 14, 2026
Anthropic Claude Mythos Preview: The More Capable AI Becomes, the More Security It Needs Apr 06, 2026
How CrowdStrike Is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 05, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Video Highlights the 4 Key Steps to Successful Incident Response
2026-04-14
Published
2026-08-18
Added to CISA KEV
Exploited in the wild