CISA Warns of Windows IKE Flaw Allowing Unauthenticated Remote Code Execution

The U. S. Cybersecurity and Infrastructure Security Agency has added a critical Microsoft Windows vulnerability to its Known Exploited Vulnerabilities catalog, warning that the flaw could allow unauthenticated remote code execution against affected systems.

Tracked as CVE-2026-33824, the issue affects Microsoft Internet Key Exchange (IKE) Service Extensions and was added to the catalog on August 18, 2026. Microsoft describes the vulnerability as a double-free weakness in the Windows IKE Service Extensions component.

Double-free bugs occur when software attempts to release the same memory allocation more than once, potentially corrupting memory and enabling an attacker to alter program execution.