Yes. CISA added CVE-2026-33824 to its Known Exploited Vulnerabilities catalogue on 18 August 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution. Any organisation running the affected product should treat remediation as urgent.
What “exploited in the wild” means for this CVE
When CISA places a CVE in the Known Exploited Vulnerabilities catalogue, it is signalling more than theoretical exposure, it is treating the issue as observed exploitation. For defenders, that changes the priority from routine patch planning to immediate exposure confirmation, containment, and remediation planning, because the window between public disclosure and further abuse is often short. The right question is not whether the flaw is interesting, but whether your environment is still reachable through it.
That distinction matters because a double free in a network-facing Windows component can be a practical remote code execution path, which means the risk is not limited to service instability. If the vulnerable product is exposed or reachable by trusted internal traffic, an attacker may be able to turn a crash-prone memory bug into code execution, especially where the host is already high value or broadly trusted.
How to confirm exposure and scope the response
Start by identifying every system that actually runs Microsoft Internet Key Exchange (IKE) Service Extensions, then determine whether those systems are internet reachable, reachable from adjacent internal zones, or present only on isolated hosts. A KEV listing is a strong cue to treat asset inventory quality as part of the response, because the usual failure mode is not lack of patching alone, it is not knowing where the vulnerable service still exists.
Use vendor guidance and the CISA KEV catalogue together to confirm the required action and any compensating controls, rather than relying on summaries or secondary writeups. If the service is business critical, look for maintenance windows that can be accelerated, service-owner dependencies that can be temporarily broken, and any hosts where the service is enabled but not operationally required. If the article about the flaw is the first time the team is hearing about the asset, that is already a response gap.
When patching is delayed, what else should change
If immediate remediation is not possible, reduce exposure first. That can mean restricting who can reach the service, tightening host-based access, removing unnecessary network paths, and increasing monitoring around the affected endpoint for crash patterns, service restarts, unusual authentication activity, or unexpected child processes. For an actively exploited bug, delay should be an exception with an owner and an expiry, not an open-ended deferral.
Because exploitation can precede a visible compromise, the practical follow-up is to check whether the host showed signs of abuse before the fix was applied. Review logs and telemetry for suspicious execution, persistence changes, lateral movement attempts, new local accounts, and any other post-exploitation indicators that fit the host role. If the affected system protects sensitive trust boundaries, also review whether credentials or sessions on that machine could have been exposed during the exploitation window.
Risk and Threat Considerations
This vulnerability is material because a remotely triggerable memory corruption flaw in a widely deployed Windows service can be used as an entry point into a trusted environment. Once exploitation is active in the wild, the main danger is not just service disruption, but unauthorised execution on a system that may already have broad network reach or privileged trust relationships.
Failure mechanism: A double free can corrupt process memory in a way that an attacker may convert into controlled execution, service instability, or both, depending on the exploit path and host conditions.
Impact: Successful exploitation can create initial access on a host that should have been treated as trusted, which can then support persistence, internal reconnaissance, or further compromise if the system is not isolated and monitored.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Actively exploited CVEs require rapid identification and remediation of exposed assets. |
| Recommendation — Prioritise detection and remediation of KEV-listed vulnerabilities across the asset inventory. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | This CVE demands prompt remediation and verification of vulnerable systems. |
| RA-5 — Vulnerability Monitoring and Scanning | Exposure confirmation depends on finding every system running the vulnerable service. | |
| Recommendation — Patch or mitigate the flaw and verify all affected hosts are remediated. Scan and inventory systems to confirm where the vulnerable component is deployed. | ||
| NIST CSF 2.0 | ID.RA-01 — Vulnerabilities are identified and recorded | A KEV-listed exploit requires identifying the vulnerability in the environment. |
| PR.IP-12 — A vulnerability management program is implemented | The response depends on a managed process for prioritising and closing exploited flaws. | |
| Recommendation — Record the CVE in risk tracking and link it to affected assets for response. Use the vulnerability management process to drive emergency remediation and exception handling. | ||
Practitioner Guidance
What to prioritise: Treat KEV-listed exploitation as a remediation queue override. Validate asset ownership, confirm whether the service is present and reachable, and move exposed systems ahead of routine patch backlogs.
What to verify: Before declaring the issue closed, verify the vulnerable service was actually removed, updated, or mitigated on every in-scope host, and confirm that the host did not show signs of compromise during the exposure window. If you cannot prove that, the response is incomplete.
Practitioner takeaway: For an actively exploited CVE, the operational question is not “have we planned remediation,” but “can this service still be reached, abused, or recovered from before an attacker does more than trigger the bug?”
Related resources from NHI Mgmt Group
- Guide: Email Security Guide
- CVE-2026-33824 (Microsoft Internet Key Exchange (IKE) Service Extensions Double Free)
- Is CVE-2026-33825 (Microsoft Defender Insufficient Granularity of Access Control) being exploited in the wild?
- Is CVE-2022-3038 (Google Chromium Network Service Use-After-Free) being exploited in the wild?
- Is CVE-2026-56155 (Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability) being exploited in the wild?