CVE-2026-33824
published 2026-04-14CVE-2026-33824: Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
PriorityP276critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
55.85%
98.9th percentile
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1607 | < 10.0.14393.9060 | 10.0.14393.9060 |
| microsoft | windows_10_1809 | < 10.0.17763.8644 | 10.0.17763.8644 |
| microsoft | windows_10_21h2 | < 10.0.19044.7184 | 10.0.19044.7184 |
| microsoft | windows_10_22h2 | < 10.0.19045.7184 | 10.0.19045.7184 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.9060 | 10.0.14393.9060 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.8644 | 10.0.17763.8644 |
| microsoft | windows_10_version_21h2 | >= 10.0.19044.0 < 10.0.19044.7184 | 10.0.19044.7184 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.7184 | 10.0.19045.7184 |
| microsoft | windows_11_23h2 | < 10.0.22631.6936 | 10.0.22631.6936 |
| microsoft | windows_11_24h2 | < 10.0.26100.8246 | 10.0.26100.8246 |
| microsoft | windows_11_25h2 | < 10.0.26200.8246 | 10.0.26200.8246 |
| microsoft | windows_11_26h1 | < 10.0.28000.1836 | 10.0.28000.1836 |
| microsoft | windows_11_version_22h3 | >= 10.0.22631.0 < 10.0.22631.6936 | 10.0.22631.6936 |
| microsoft | windows_11_version_23h2 | >= 10.0.22631.0 < 10.0.22631.6936 | 10.0.22631.6936 |
| microsoft | windows_11_version_24h2 | >= 10.0.26100.0 < 10.0.26100.8246 | 10.0.26100.8246 |
| microsoft | windows_11_version_25h2 | >= 10.0.26200.0 < 10.0.26200.8246 | 10.0.26200.8246 |
| microsoft | windows_11_version_26h1 | >= 10.0.28000.0 < 10.0.28000.1836 | 10.0.28000.1836 |
| microsoft | windows_server_2016 | < 10.0.14393.9060 | 10.0.14393.9060 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.9060 | 10.0.14393.9060 |
| microsoft | windows_server_2019 | < 10.0.17763.8644 | 10.0.17763.8644 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.8644 | 10.0.17763.8644 |
| microsoft | windows_server_2022 | < 10.0.20348.5020 | 10.0.20348.5020 |
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.5020 | 10.0.20348.5020 |
| microsoft | windows_server_2022_23h2 | < 10.0.25398.2274 | 10.0.25398.2274 |
| microsoft | windows_server_2025 | < 10.0.26100.32690 | 10.0.26100.32690 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for anomalous or specially crafted IKEv2 packets sent to Windows hosts with Internet Key Exchange version 2 enabled, as exploitation involves unauthenticated network-based packet delivery to ikeext.dll. ↗
- →Focus detection on the IKE/AuthIP IPsec Keying Modules service (ikeext.dll) for double-free memory corruption indicators, such as unexpected crashes, heap corruption events, or process anomalies in the ikeext service process. ↗
- →Prioritize patching and detection on internet-exposed Windows systems with IKEv2 enabled, given the critical CVSS score of 9.8 and unauthenticated remote code execution potential. ↗
- ·The vulnerability is in the Windows IKE Extension (ikeext.dll) and is only exploitable on machines where IKEv2 is enabled; systems without IKEv2 active are not directly exposed to this attack vector. ↗
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q6qf-3m2m-xq4f: Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network
ghsa_unreviewed·2026-04-14
CVE-2026-33824 [CRITICAL] CWE-415 GHSA-q6qf-3m2m-xq4f: Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
VulDB
Microsoft Windows up to Server 2025 IKE Service Extensions double free
vuldb·2026-04-14·CVSS 9.8
CVE-2026-33824 [CRITICAL] Microsoft Windows up to Server 2025 IKE Service Extensions double free
A vulnerability described as very critical has been identified in Microsoft Windows. Affected by this vulnerability is an unknown functionality of the component IKE Service Extensions. Executing a manipulation can lead to double free.
The identification of this vulnerability is CVE-2026-33824. The attack may be launched remotely. There is no exploit available.
Upgrading the affected component is recommended.
No detection rules found.
No public exploits indexed.
Hackernews
Microsoft's MDASH AI System Finds 16 Windows Flaws Fixed in Patch Tuesday
blogs_hackernews·2026-05-13
CVE-2026-33824 Microsoft's MDASH AI System Finds 16 Windows Flaws Fixed in Patch Tuesday
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Microsoft's MDASH AI System Finds 16 Windows Flaws Fixed in Patch Tuesday
Microsoft has unveiled a new multi-model artificial intelligence (AI)-driven system called MDASH to facilitate vulnerability discovery and remediation at scale, adding that it's being tested by some customers as part of a limited private preview.
MDASH, short for m ulti-mo d el a gentic s canning h arness, is designed as a model-agnostic system that uses bespoke AI agents for different vulnerability classes to autonomously discover, validate, and prove exploitable defects in complex codebases like Windows.
"Unlike single-model approaches, the harness
Hackernews
⚡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking & More
blogs_hackernews·2026-04-27
CVE-2025-20333 ⚡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking & More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking & More
Everything is dumb again. This week feels broken in a very familiar way. Old tricks are back. New tools are doing shady crap. Supply chains got hit. Fake help desks worked. Weird research showed how easy some attacks still are.
Most of it feels like stuff we should have fixed years ago. Bad extensions. Stolen creds. Remote tools are getting abused. Malware hides in places people trust. Same mess, cleaner packaging.
Coffee is cold. The vuln list is ugly. Let’s get into it.
## ⚡ Threat of the Week
New fast16 Malware Was Developed Y
Hackernews
Microsoft Issues Patches for SharePoint Zero-Day and 168 Other New Vulnerabilities
blogs_hackernews·2026-04-15·CVSS 7.5
[HIGH] Microsoft Issues Patches for SharePoint Zero-Day and 168 Other New Vulnerabilities
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Microsoft Issues Patches for SharePoint Zero-Day and 168 Other New Vulnerabilities
Microsoft on Tuesday released updates to address a record 169 security flaws across its product portfolio, including one vulnerability that has been actively exploited in the wild.
Of these 169 vulnerabilities, 157 are rated Important, eight are rated Critical, three are rated Moderate, and one is rated Low in severity. Ninety-three of the flaws are classified as privilege escalation, followed by 21 information disclosure, 21 remote code execution, 14 security feature bypass, 10 spoofing, and nine denial-of-service vulnerabilities.
Also inclu
Tenable
Microsoft’s April 2026 Patch Tuesday Addresses 163 CVEs (CVE-2026-32201)
blogs_tenable·2026-04-14·CVSS 6.5
[MEDIUM] Microsoft’s April 2026 Patch Tuesday Addresses 163 CVEs (CVE-2026-32201)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days
blogs_bleepingcomputer·2026-04-14·CVSS 6.5
[MEDIUM] Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days
## Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days
## Lawrence Abrams
Today is Microsoft's April 2026 Patch Tuesday with security updates for 167 flaws, including 2 zero-day vulnerabilities.
This Patch Tuesday also addresses eight "Critical" vulnerabilities, 7 of which are remote code execution flaws and the other is a denial of service flaw.
The number of bugs in each vulnerability category is listed below:
93 Elevation of Privilege Vulnerabilities
13 Security Feature Bypass Vulnerabilities
20 Remote Code Execution Vulnerabilities
21 Information Disclosure Vulnerabilities
10 Denial of Service Vulnerabilities
9 Spoofing Vulnerabilities
When BleepingComputer reports on Patch Tuesday security updates, we only count those released by Microsoft today.
Therefore, the
Talos
Microsoft Patch Tuesday for April 2026 - Snort Rule and Prominent Vulnerabilities
blogs_talos·2026-04-14·CVSS 7.5
CVE-2026-23666 [HIGH] Microsoft Patch Tuesday for April 2026 - Snort Rule and Prominent Vulnerabilities
## Microsoft Patch Tuesday for April 2026 - Snort Rule and Prominent Vulnerabilities
Microsoft has released its monthly security update for April 2026, which includes 165 vulnerabilities affecting a wide range of products, including eight Microsoft marked as “critical.”
CVE-2026-23666 is a critical Denial of Service (DoS) vulnerability that affects the .NET framework. Successful exploitation could allow the attacker to deny service over the network.
CVE-2026-32157 is a critical use after free vulnerability in the Remote Desktop Client that results in code execution. Attack requires an authorized user on the client to connect to a malicious server, which could result in code execution on the client.
CVE-2026-32190 is a critical user after free vulnerability in Microsoft Office that can
Qualys
Microsoft and Adobe Patch Tuesday, April 2026 Security Update Review
blogs_qualys·2026-04-14
Microsoft and Adobe Patch Tuesday, April 2026 Security Update Review
## Table of Contents
Microsoft Patch Tuesday forApril2026
Adobe Patches for April2026
Zero-day Vulnerabilities Patched inAprilPatch Tuesday Edition
Critical Severity Vulnerabilities Patched inAprilPatch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Qualys Monthly Webinar Series
April 2026’s Patch Tuesday arrives with Microsoft addressing a fresh set of vulnerabilities across its ecosystem, reinforcing the ongoing need for timely patching in an increasingly threat-heavy landscape. Here’s a quick breakdown of what you need to know.
## Microsoft Patch Tuesday for April 2026
This month’s release addresses 163 vulnerabilities, including eight critical and 154 important-severity vulnerabilities.
In this month’s updates, Microsoft has addressed one
Sans Isc
Microsoft Patch Tuesday April 2026., (Tue, Apr 14th)
blogs_sans_isc·2026-04-14·CVSS 8.8
[HIGH] Microsoft Patch Tuesday April 2026., (Tue, Apr 14th)
Microsoft Patch Tuesday April 2026.
Published: 2026-04-14. Last Updated: 2026-04-14 17:46:09 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)
This month's Microsoft Patch Tuesday looks like a record one, but let's look at it a bit closer to understand what is happening
The update patches a total of 243 vulnerabilities. However, 78 of them are Chromium issues affecting Microsoft Edge. Patches for Edge were released earlier. This leaves 165 vulnerabilities that are not Edge-related. Of these, 8 are rated critical, and 154 are important. One vulnerability has already been exploited, and another was made public before today but has not yet been seen in the wild.
Noteworthy Vulnerabilities:
CVE-2026-33827 (Windows TCP/IP Remote Code Execution Vulnerability): As a packet nerd, I love thes
Rapid7
Patch Tuesday - April 2026
blogs_rapid7·2026-04-14·CVSS 6.5
[MEDIUM] Patch Tuesday - April 2026
Microsoft is publishing 167 vulnerabilities on April 2026 Patch Tuesday . Microsoft is aware of exploitation in the wild for one of today’s vulnerabilities, and public disclosure for one other. Microsoft evaluates 19 of the vulnerabilities published today as more likely to see future exploitation. So far this month, Microsoft has provided patches to address 80 browser vulnerabilities, which are not included in the Patch Tuesday count above.
## Increasing volumes of vulnerabilities
Regular Patch Tuesday watchers will know that these vulnerability totals are significantly higher than usual, especially the browser numbers. Late last week, Microsoft published patches to resolve more than 60 browser vulnerabilities in a single day, which is a new record in that very specific category.
It mig
Crowdstrike
April 2026 Patch Tuesday: Two Zero-Days and Eight Critical Vulnerabilities Among 164 CVEs
blogs_crowdstrike
April 2026 Patch Tuesday: Two Zero-Days and Eight Critical Vulnerabilities Among 164 CVEs
April 2026 Patch Tuesday: Two Zero-Days and Eight Critical Vulnerabilities Among 164 CVEs Apr 14, 2026
Anthropic Claude Mythos Preview: The More Capable AI Becomes, the More Security It Needs Apr 06, 2026
How CrowdStrike Is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 05, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
April 2026 Patch Tuesday: Two Zero-Days and Eight Critical Vulnerabilities Among 164 CVEs Apr 14, 2026
Anthropic Claude Mythos Preview: The More Capable AI Becomes, the More Security It Needs Apr 06, 2026
How CrowdStrike Is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 05, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Video Highlights the 4 Key Steps to Successful Incident Response
2026-04-14
Published