CISA confirmed on 18 August that a critical flaw in Windows' built-in VPN key-exchange service, CVE-2026-33824, is being actively exploited. The bug sits in the Internet Key Exchange (IKE) Service Extensions component, and it's about as bad as they come: an attacker needs no credentials at all — just the ability to send a crafted network packet to UDP port 500 or 4500 — to trigger a memory-corruption flaw (a "double free") and run code on the target machine. It affects every supported release of Windows 10, Windows 11 and Windows Server. CISA rated it 9.8 out of 10 and gave U.S. federal agencies just three days to patch under Binding Operational Directive 26-04; researchers at Palo Alto Networks say they've already observed a threat actor manually exploiting it against VPN endpoints in the wild.
The unusual part is the timeline: Microsoft actually shipped the fix back in April 2026's Patch Tuesday. CISA's Known Exploited Vulnerabilities listing this week isn't announcing a new hole — it's confirming that attackers are now going after machines that were never updated with a four-month-old patch. That's the real lesson here: a patch existing doesn't mean it's installed everywhere, and IKE is exactly the kind of service — quietly running on any machine with VPN or IPsec configured — that's easy to lose track of in an update cycle.
What this means for your business
- If any of your servers or office machines run a site-to-site VPN or IPsec connection, confirm they're on the April 2026 Windows cumulative update or later. This is a case where "we probably patched that months ago" is worth actually checking, not assuming.
- If a machine doesn't need IKE/VPN at all, block inbound UDP ports 500 and 4500 at the firewall. That single rule closes the door regardless of patch status, and it's a five-minute change on most business firewalls.
- Where IKE is genuinely in use, restrict inbound traffic on those ports to known peer IP addresses rather than leaving them open to the internet — unauthenticated exposure to the whole internet is what makes this bug remotely exploitable in the first place.
None of this requires new software or a big project — it's a patch-verification and firewall-rule check that most IT teams or managed-service providers can confirm within the hour.