IKE VPN endpoint exploitation attempt - possible CVE-2026-33824 activity (stage 1 of 2, awaiting callback correlation)

Duo Tech@duotech

•updated Jul 30, 2026•1•0•10

Detects CVE-2026-33824 IKE VPN endpoint exploitation traffic (UDP 500/4500) correlated within a 5-minute window with a subsequent outbound reverse-shell callback from the same host.