Critical Windows Flaw Exploited in the Wild, CISA Warns
A critical remote code execution (RCE) vulnerability in the Windows Internet Key Exchange (IKE) Service Extensions component is being actively exploited by hackers. This means that anyone can send malicious packets to an unpatched Windows system, potentially allowing attackers to gain control of it.
The vulnerability, tracked as CVE-2026-33824, affects all supported versions of Windows 10, Windows 11, and Windows Server, including the latest releases. It allows attackers without any privileges to execute code on a targeted system by sending specially crafted packets through UDP ports 500 or 4500.
Microsoft first addressed this vulnerability in April as part of its Patch Tuesday updates. In an advisory at the time, Microsoft warned that an unauthenticated attacker could send malicious packets to a Windows machine with IKE version 2 enabled, allowing for remote code execution. The company also provided guidance on how to mitigate the risk, including blocking inbound traffic through UDP ports 500 and 4500 or configuring firewall rules to only allow traffic from known peer addresses when IKE is used.
However, it appears that attackers have already begun exploiting this vulnerability in the wild. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-33824 to its catalog of actively exploited vulnerabilities and ordered all U.S. Federal Civilian Executive Branch agencies to secure their devices within three days.
“CISA is urging all network defenders to prioritize patching this vulnerability to block ongoing attacks,” the agency warned in a statement. “This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.”
The news comes as part of a growing trend of actively exploited vulnerabilities in Microsoft products. Since November 2021, CISA has identified over 385 such vulnerabilities in various Microsoft products, with many being used by ransomware gangs.
To protect yourself from this vulnerability, it is essential to install the latest security updates for your Windows system. If you cannot immediately apply these updates, consider blocking inbound traffic through UDP ports 500 and 4500 or configuring firewall rules to only allow traffic from known peer addresses when IKE is used. Remember that even if attackers gain initial access, proper patching can significantly reduce the risk of further exploitation.
In light of this warning, it’s crucial for network defenders to prioritize patching and take proactive measures to protect their systems. By staying up-to-date with the latest security updates and configuring your firewall rules accordingly, you can minimize the risk of falling victim to this vulnerability.
Source: Bleeping Computer — 2026-08-19