Executive Summary
CVE-2026-33824 is a critical pre-authentication remote code execution (RCE) vulnerability in the Windows Internet Key Exchange (IKE) service, affecting all modern Windows Server and Client versions. Microsoft issued patches in April 2026, but the threat escalated significantly when CISA added it to the Known Exploited Vulnerabilities (KEV) catalog in August 2026. Evidence from Palo Alto Networks Unit 42 links manual exploitation attempts, including reverse-shell callbacks, to a Chinese-speaking threat actor utilizing AI-assisted offensive workflows such as Hermes Agent.
The vulnerability (CWE-415) resides in the way `ikeext.dll` handles fragmented IKEv2 messages. A remote attacker can trigger a double-free condition during the reassembly of `IKE_AUTH` packets before any peer authentication occurs. Because the IKEEXT service runs in the SYSTEM context, successful exploitation allows for complete compromise of the affected host. This is particularly dangerous for internet-facing VPN gateways and IPsec endpoints.
Organizations must prioritize patching internet-exposed Windows-based VPN infrastructure. While AI was used for campaign orchestration, the exploitation of this specific vulnerability has been documented as a manual process. The urgency is high given its unauthenticated nature and the potential for SYSTEM-level access.