Back

CVE-2026-33824

CRITICAL CISA KEV

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

Published: Apr 14, 2026 Modified: Aug 19, 2026
CWE-415

CVSS Metrics

CVSSv3
Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (23)

Vendor Product Version
microsoft windows_10_1607 * < 10.0.14393.9060
microsoft windows_10_1607 * < 10.0.14393.9060
microsoft windows_10_1809 * < 10.0.17763.8644
microsoft windows_10_1809 * < 10.0.17763.8644
microsoft windows_10_21h2 * < 10.0.19044.7184
microsoft windows_10_21h2 * < 10.0.19044.7184
microsoft windows_10_21h2 * < 10.0.19044.7184
microsoft windows_10_22h2 * < 10.0.19045.7184
microsoft windows_10_22h2 * < 10.0.19045.7184
microsoft windows_10_22h2 * < 10.0.19045.7184
microsoft windows_11_23h2 * < 10.0.22631.6936
microsoft windows_11_23h2 * < 10.0.22631.6936
microsoft windows_11_24h2 * < 10.0.26100.8246
microsoft windows_11_24h2 * < 10.0.26100.8246
microsoft windows_11_25h2 * < 10.0.26200.8246
microsoft windows_11_25h2 * < 10.0.26200.8246
microsoft windows_11_26h1 * < 10.0.28000.1836
microsoft windows_11_26h1 * < 10.0.28000.1836
microsoft windows_server_2016 * < 10.0.14393.9060
microsoft windows_server_2019 * < 10.0.17763.8644

…and 3 more

GitHub Security Advisory GHSA-q6qf-3m2m-xq4f

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

Risk Scores

CVSS Score 9.8 / 10
EPSS Score 77.90%

Top 0% most likely to be exploited

Threat Score 92.6 / 100

CISA Known Exploited

Date Added: 2026-08-18
Due Date: 2026-08-21
Required Action:

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Data Sources

NVD CISA KEV EPSS GitHub