Critical RCE Vulnerability in Windows IKE Actively Exploited

CISA has issued a warning regarding the active exploitation of a critical remote code execution (RCE) vulnerability in the Windows Internet Key Exchange (IKE) Service Extensions, tracked as CVE-2026-33824. This flaw affects all supported versions of Windows 10, Windows 11, and Windows Server, allowing unauthenticated attackers to execute code remotely by sending specially crafted packets through UDP ports 500 or 4500. Microsoft addressed this vulnerability in April 2026, but it has only recently been added to CISA's catalog of actively exploited vulnerabilities. CISA has mandated that U.S. Federal Civilian Executive Branch agencies secure their devices within three days. Additionally, other vulnerabilities in Microsoft SharePoint and VMware vCenter are also under active attack, highlighting a broader trend of exploitation across multiple platforms. Security teams are urged to prioritize patching and monitoring for signs of intrusion. The situation is critical as attackers leverage these vulnerabilities to gain unauthorized access.

Key Points: • CVE-2026-33824 is a critical RCE vulnerability in Windows IKE, affecting multiple Windows versions. • CISA has mandated federal agencies to secure devices within three days due to active exploitation. • Other vulnerabilities in Microsoft SharePoint and VMware vCenter are also being actively exploited.