--- schema: 1 kind: threat title: > Unit 42 recovers a live autonomous-AI attack operation after it exposed its own home directory — the confirmed compromises came from manual Citrix NetScaler exploitation (CVE-2026-3055), not the agent headline: > The autonomous agent attacked at scale and landed nothing; the same operator's hand-driven NetScaler exploitation took data from three organisations summary: > Palo Alto Unit 42 obtained full visibility into a Chinese-speaking operator's offensive tooling after the operator's own agent framework started an HTTP file server from its home directory, exposing tool configurations, API keys, exploit scripts, target lists and session logs. The operator ran DeepSeek behind the open-source Hermes Agent for fully autonomous target enumeration and exploitation against seven CVEs and more than 460 targets — and every autonomous exploitation attempt failed, defeated only by target-side configuration. The three confirmed compromises came from the operator's own manual work against Citrix NetScaler ADC/Gateway (CVE-2026-3055), exfiltrating appliance memory and searching it for session cookies, including multi-day targeting of a Malaysian government entity. That CVE is KEV-listed and was already being exploited by an unrelated cluster months earlier. discovered_at: "2026-07-31T04:09:14Z" updated_at: "2026-08-19T04:45:00Z" event_date: 2026-07-30 run_id: 2026-07-31T0409Z-intel priority: high immediate_action: null tags: - ai-abuse - vulnerabilities - actively-exploited - cisa-kev - info-disclosure - identity - espionage - rce - pre-auth - patch-available regions: - global - apac - europe sectors: - public-sector - technology - energy - healthcare - finance - telco entities: - "actor:knaithe-knyuan" - "tool:hermes-ai-agent" techniques: - T1595 - T1595.002 - T1190 - T1539 - T1102 - T1090.003 - T1588.005 - T1059 - T1068 affected_products: - Citrix NetScaler ADC - Citrix NetScaler Gateway - Langflow - n8n - Apache Tomcat - Marimo - Palo Alto Networks PAN-OS - Marimo Notebook - Microsoft Windows - Microsoft Windows Server cves: - id: CVE-2026-3055 cvss: "9.3" epss: "0.78" type: info-disclosure vector: zero-click auth: pre-auth status: - exploited - cisa-kev - patch-available affected: > NetScaler ADC and Gateway before 13.1-62.23 and before 14.1-66.59, and 13.1-FIPS/NDcPP before 13.1-37.262 — only when configured as a SAML Identity Provider fixed: "13.1-62.23; 14.1-66.59; 13.1-FIPS/NDcPP 13.1-37.262" - id: CVE-2026-39987 cvss: "9.3" epss: null type: rce vector: zero-click auth: pre-auth status: - exploited - cisa-kev - patch-available affected: > marimo prior to 0.23.0 — the terminal WebSocket endpoint /terminal/ws performs no authentication validation, so an unauthenticated attacker obtains a full PTY shell (CWE-306), per the CVE record that owns the identifier. Unit 42 states no version boundary in its post; the boundary and the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H come from the owning record, not from Unit 42's table. fixed: > marimo 0.23.0. The flaw was published 2026-04-09 and is CISA KEV-listed; it was covered here on 2026-05-30. The patch has been available for months, which is what makes the exposure question here a compromise-assessment question rather than a discovery of something new to install. - id: CVE-2026-33824 cvss: "9.8" epss: "0.5585" type: memory-corruption vector: zero-click auth: pre-auth status: - exploited - cisa-kev - patch-available affected: > Windows Server 2016 (< 10.0.14393.9060), 2019 (< 10.0.17763.8644), 2022 (< 10.0.20348.5020), 2022 23H2 Server Core (< 10.0.25398.2274), 2025 (< 10.0.26100.32690); Windows 10 v1607/v1809 (< 10.0.14393.9060 / 10.0.17763.8644), v21H2 (< 10.0.19044.7184), v22H2 (< 10.0.19045.7184); Windows 11 v22H3/23H2 (< 10.0.22631.6936), v24H2 (< 10.0.26100.8246), v25H2 (< 10.0.26200.8246), v26H1 (< 10.0.28000.1836) fixed: April 2026 cumulative security update (2026-04-14) — per-build fixed versions above sources: - url: "https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/" publisher: Unit 42 (Palo Alto Networks) date: 2026-07-30 role: primary - url: "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300" publisher: Citrix (Cloud Software Group) — security bulletin CTX696300 date: 2026-03-23 role: primary - url: "https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2/" publisher: watchTowr Labs date: 2026-03-29 role: corroborating - url: "https://0patch.com/blog/micropatches-released-for-windows-ike-service-extensions" publisher: 0patch (ACROS Security) date: 2026-08-05 role: primary - url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824" publisher: Microsoft Security Response Center date: 2026-04-14 role: corroborating - url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" publisher: "CISA Known Exploited Vulnerabilities catalog (feed, version 2026.08.18)" date: 2026-08-18 role: primary - url: "https://euvd.enisa.europa.eu/enisa/eu_vulnerability_database/EUVD-2026-22641" publisher: ENISA EU Vulnerability Database date: 2026-08-18 role: corroborating closed_sources: [] evidence: - quote: "Across all the exploitation attempts, both autonomous and manual, Unit 42 was only able to confirm three targets were successfully exploited." publisher: Unit 42 (Palo Alto Networks) - quote: "The three successful exploitations had memory data exfiltrated through the Citrix NetScaler out-of-bounds memory read vulnerability (CVE-2026-3055). The actor searched the exfiltrated data for NetScaler authentication cookies (NSC_AAAC=), indicating session hijacking intent." publisher: Unit 42 (Palo Alto Networks) - quote: "Autonomous AI-driven attack cycles are operationally viable, and the margin of failure was narrow: Exploitation was prevented by target-side configuration requirements — the absence of prerequisite workflow configurations (Langflow) and authentication on form endpoints (n8n). Targets with weaker default configurations would have been susceptible." publisher: Unit 42 (Palo Alto Networks) - quote: "Across all the exploitation attempts, both autonomous and manual, Unit 42 confirmed data exfiltration from three Citrix NetScaler targets (CVE-2026-3055) and command execution on 11 Marimo notebook endpoints (CVE-2026-39987)." publisher: Unit 42 - quote: "This is a pre-authentication double free in ikeext.dll, the module behind the \"IKE and AuthIP IPsec Keying Modules\" service, which runs as Local System inside a svchost.exe. The flaw is in function IkeReinjectReassembledPacket, on the IKEv2 fragment reassembly path." publisher: 0patch (ACROS Security) - quote: "We recreated a POC from the official patch, which allowed us to reproduce the issue and create patches" publisher: 0patch (ACROS Security) - quote: "An unauthenticated attacker could send specially crafted packets to a Windows machine with Internet Key Exchange (IKE) version 2 enabled, which could enable remote code execution." publisher: Microsoft Security Response Center - quote: Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution. publisher: CISA Known Exploited Vulnerabilities catalog - quote: Block inbound traffic on UDP ports 500 and 4500 for systems that do not use IKE. publisher: Microsoft Security Response Center - quote: "For systems that require IKE, configure firewall rules to allow inbound traffic on UDP ports 500 and 4500 only from known peer addresses." publisher: Microsoft Security Response Center verification: multi-source sourcing_note: > The campaign account, the recovered tooling and the exploitation outcomes are Unit 42's own first-hand analysis. The CVE-2026-3055 record is built from the authorities that own it rather than from the campaign write-up: the SAML Identity Provider precondition, the affected and fixed version ranges and the KEV status come from the CVE record and the vendor bulletin, none of which Unit 42 states, and the independent earlier exploitation is watchTowr's honeypot observation. Unit 42's own report contains an unresolved tension this entry does not resolve by inference: its narrative confines confirmed exploitation to the three NetScaler cases while its CVE table separately describes the Marimo activity as confirmed command execution. Both are reported as stated. confidence: high references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: B credibility: 2 watchlist_hit: false actions: - "Confirm every internet-facing NetScaler ADC/Gateway is on 13.1-62.23, 14.1-66.59 or 13.1-FIPS/NDcPP 13.1-37.262 or later, and on any appliance configured as a SAML Identity Provider that ran an earlier build, invalidate existing AAA sessions rather than assuming the patch ended the exposure — the flaw leaks live session material from appliance memory." - "Confirm every marimo notebook instance is on 0.23.0 or later and that none answers from outside the development network — then, separately, compromise-assess any instance that was exposed while below 0.23.0, because Unit 42 records command execution as confirmed on 11 endpoints in this campaign rather than merely attempted, and the patch does not evict an attacker who already had a PTY shell." - "Confirm the April 2026 cumulative update is installed on every Windows host that answers IKEv2 — VPN gateways, Always On VPN endpoints and any domain member running Routing and Remote Access — and treat an unpatched internet-reachable responder as a compromise-assessment candidate rather than a patch backlog item; where a host cannot be patched this cycle, apply Microsoft's stated interim control (block inbound UDP 500/4500 on systems not using IKE, restrict those ports to known peers on systems that do)." updates: - at: "2026-08-02T14:05:00Z" run_id: 2026-08-02T1309Z-audit type: correction summary: > The 2026-07-31 entry here on Unit 42's autonomous-AI intrusion campaign framed the operation as landing three confirmed compromises, all from the operator's manual NetScaler work, and supported it with an evidence quote attributed to Unit 42 that does not appear in Unit 42's post. The real sentence records data exfiltration from three Citrix NetScaler targets (CVE-2026-3055) AND command execution on 11 Marimo notebook endpoints (CVE-2026-39987), and Unit 42's own CVE table lists CVE-2026-39987 with command execution confirmed. Two further CVEs carry confirmed attempts: reverse shells against nine Apache Tomcat servers (CVE-2026-34486) and callbacks from three IKE VPN endpoints (CVE-2026-33824). The operational consequence is an exposure list four CVEs long rather than one, with Marimo Notebook the addition most likely to be missing from an asset inventory. fields: - actions - affected_products - cves - evidence - tags - techniques - body merged_from: 2026-08-02/unit42-autonomous-campaign-confirmed-impact-was-understated - at: "2026-08-10T04:55:00Z" run_id: 2026-08-10T0411Z-intel type: update summary: > 0patch published a root-cause analysis on 2026-08-05 placing CVE-2026-33824 in ikeext.dll — the module behind the IKE and AuthIP IPsec Keying Modules service, which runs as Local System — on the IKEv2 fragment-reassembly path, where an unauthenticated attacker who can reach UDP 500/4500 on a host acting as an IKEv2 responder can free the same heap block twice. Microsoft's own record independently corroborates the CVE as a CWE-415 double free, CVSS 9.8, patched 2026-04-14 across Windows Server 2016 through 2025 and Windows 10 1607 through Windows 11 26H1, with exploitation and public disclosure both recorded as no. This closes an evidence gap on tracked ground: the campaign entry that names this CVE described it only as callbacks from three IKE VPN endpoints. fields: - affected_products - cves - evidence - sources - tags - techniques - body merged_from: 2026-08-10/cve-2026-33824-ikeext-double-free-root-cause-published - at: "2026-08-19T04:45:00Z" run_id: 2026-08-19T0410Z-intel type: update summary: > CISA added CVE-2026-33824 to its Known Exploited Vulnerabilities catalog on 2026-08-18, changing what was recorded here on 2026-08-10 when the flaw was covered as patched but not confirmed exploited. Nothing about the remediation changes — the fix shipped in Microsoft's April 2026 cumulative updates — but the exposure now carries a federal exploitation determination: an unauthenticated attacker reaching UDP 500 or 4500 on any Windows host acting as an IKEv2 responder can free the same heap block twice and execute code in the Local System context of the IKEEXT service. The determination rests on that one authority — ENISA's database carries the same date and an EPSS of 55.85 but mirrors CISA rather than assessing independently — and Microsoft's record has not been revised since 14 April, still recording exploitation as no with an assessment of "Exploitation Less Likely", so an estate that triaged this CVE on the vendor's exploitability signal alone ranked it too low. fields: - actions - cves - evidence - sectors - sources - body merged_from: 2026-08-19/cve-2026-33824-ikeext-kev-confirmed-exploited - at: "2026-08-28T15:00:00Z" run_id: 2026-08-28T1500Z-audit type: improvement internal: true summary: > v4.2 migration: pipeline-internal phrasing removed from the correction section; updated_at recomputed under the new float rule where applicable. fields: [actions, cves, body] - at: "2026-09-06T13:50:00Z" run_id: 2026-09-06T1308Z-audit type: correction summary: > The EPSS recorded for CVE-2026-33824 was ENISA EUVD's percentage rendering (55.85) rather than the probability the field holds. EUVD publishes EPSS multiplied by one hundred, so the value is a probability of 0.5585. Corrected in the CVE record and in the main analysis. The 2026-08-19 changelog record quotes the figure as it stood and is left untouched, the changelog being append-only. fields: [cves, body] migrated_from: null --- Palo Alto Unit 42 published an unusually complete reconstruction of a live offensive operation on 2026-07-30, made possible by the operator's own mistake: its agent framework, acting on a command sent over Telegram, started an HTTP file server from the operator's home directory rather than an isolated staging path, exposing AI tool configurations, API keys, exploit scripts, target lists, shell history and the agent's own session logs ([Unit 42, 2026-07-30](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/)). Unit 42 notes this was out of character — the same operator had emptied exploit directories after use and disabled conversation logging in one of its tools. The operator, who uses the handles knaithe and KnYuan and describes themselves as a Zhuhai-based binary-security researcher, ran DeepSeek as the reasoning engine behind the open-source Hermes Agent, extended with three capabilities: a framework-bundled jailbreak skill, a custom module for attacking unauthenticated WebSocket endpoints, and a custom procedure that drives internet-wide asset enumeration through a scanning service, wired to a natural-language-to-search-query translator exposed to the agent as a tool. **The result is the part worth reading carefully.** Unit 42 states it could confirm only three successful exploitations across every attempt, autonomous and manual, and identifies those three as the Citrix NetScaler cases. Both fully autonomous exploitation attempts failed. Against Langflow, the agent needed either a login-bypass setting enabled or a public flow identifier and found neither; against n8n — which its scanning put at 647,017 instances globally and 25,209 in China — it worked the Chinese slice, sampled about a hundred, probed roughly forty, found three candidates, and was stopped because the unauthenticated form endpoint the exploit chain required was behind authentication on every one. Unit 42's own reading is that the failures were target-side configuration, not defensive detection, and that targets with weaker defaults would have been compromised — a hardening finding rather than a ceiling on the capability. The agent's decision-making is visible in the recovered logs: it abandoned the Langflow target set after assessing the deployment population as too small to be worth the effort and pivoted to a more widely deployed product on its own. **What actually worked was hand-driven.** Using CVE-2026-3055, an out-of-bounds memory read in Citrix NetScaler ADC and Gateway, the operator exfiltrated appliance memory from three organisations and searched the recovered bytes for NetScaler authentication cookies, which Unit 42 reads as session-hijacking intent. It describes persistent multi-day targeting of a Malaysian government entity using memory-grooming parameters and maximum read attempts, with the operator returning behind proxy anonymisation on later attempts — behaviour it contrasts with the autonomous campaigns, which hit Chinese domestic infrastructure indiscriminately. Other manual activity included command execution against Marimo notebook instances, deserialization reverse-shell attempts against Tomcat servers and callbacks against Windows IKE VPN endpoints; a cloned PAN-OS exploit was non-functional, carrying placeholder values that cannot achieve code execution, with no evidence of modification or execution found. The CVE itself deserves separate attention from the AI story, because it is the element with direct constituency exposure. It affects NetScaler ADC and Gateway only when the appliance is configured as a SAML Identity Provider — a precondition Unit 42 does not mention and which comes from the vulnerability record and the vendor's bulletin ([Citrix, 2026-03-23](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300)). It is KEV-listed, and watchTowr's honeypot network observed exploitation from known threat-actor addresses as of 2026-03-27, months before and unrelated to this operator ([watchTowr Labs, 2026-03-29](https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2/)). watchTowr also documents a second overread path under the same CVE reachable through a different endpoint, so an operator validating exposure should not assume a single request signature covers it. Unit 42 also reports that the operator routed two Western tools, Claude Code and Codex, through a third-party proxy with attribution headers disabled and response storage turned off. It says Claude Code was used only for connectivity testing and proxy validation, its session history holding model checks, connectivity tests and one package-install request across three sessions, and that there were signs of Codex use in exploit-development directories though those chat logs were not preserved — and it relays OpenAI's confirmation that its provider-side safeguards refused the policy-violating requests and that its safety systems flagged and disabled the linked account before Unit 42 shared intelligence. Unit 42's inference is that the operator chose the model with the fewest controls for the autonomous engine precisely because provider-side controls limited the alternatives. **Detection.** For the NetScaler exposure the observable is in the appliance's own web logs: repeated requests to the SAML identity-provider endpoints from a single source, returning responses whose length varies request to request, with no corresponding completed authentication — memory-overread harvesting looks like a failing login loop that never fails cleanly. Follow it with authentication telemetry: a session cookie presented from an address or client fingerprint that never performed the sign-in that minted it is the downstream consequence the operator was working toward. More broadly, the enumeration behaviour Unit 42 describes leaves an approach signature worth hunting on any exposed application — high-volume version-fingerprinting requests from a narrow address set, followed within a short window by a small number of precisely-targeted exploit attempts against just the instances whose version replied in scope. **Triage:** scanning noise against edge appliances is constant, so volume alone discriminates nothing. Two things separate this from background scanning: the requests target the specific identity-provider paths rather than sweeping the whole surface, and successful reads produce responses that are neither errors nor valid authentication outcomes. On the enumeration side, ordinary vulnerability scanners announce themselves through breadth and user-agent consistency; what Unit 42 describes is narrow, sequenced and selective — a fingerprint pass followed by exploitation of only the matching subset. **Defender takeaway:** the headline is not that an AI agent ran an attack — it is that the agent's attacks all failed against configuration and the human's did not. For the constituency the practical item is unglamorous: a SAML-IDP-configured NetScaler on an unpatched build leaks session material to anyone who asks, and it has been exploited by more than one unrelated actor since March. The secondary lesson is that the two products the agent chose autonomously, Langflow and n8n, are exactly the kind of self-hosted workflow and AI-orchestration software that spreads through research and public-sector environments without going through an asset inventory, and that in both cases the thing that saved the targets was an authentication setting rather than a patch. ## Correction — 2026-08-02T14:05:00Z The original entry understated the campaign's confirmed impact, and it did so on the strength of a quotation Unit 42 did not write. The original entry carried, inside quotation marks and attributed to Unit 42, a sentence reading "Across all the exploitation attempts, both autonomous and manual, Unit 42 was only able to confirm three targets were successfully exploited." Unit 42's actual sentence, at the same point in the post, is "Across all the exploitation attempts, both autonomous and manual, Unit 42 confirmed data exfiltration from three Citrix NetScaler targets (CVE-2026-3055) and command execution on 11 Marimo notebook endpoints (CVE-2026-39987)" ([Unit 42, 2026-07-30](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/)). The fabricated version dropped the second half of the finding and added a limiting phrase — "was only able to confirm" — that carries an editorial judgement the source does not make. Unit 42's own CVE table is unambiguous on the omitted half: its row for CVE-2026-39987 gives the product as Marimo Notebook, the score as 9.8, the exploitation method as manual, and the status as active exploitation with command execution confirmed. The post's confirmed-impact list runs to four entries rather than one: data exfiltration from three organisations via the Citrix NetScaler flaw, command execution on 11 Marimo notebook instances, Java deserialization reverse-shell attempts against nine Apache Tomcat servers (CVE-2026-34486), and reverse-shell callbacks targeting three IKE VPN endpoints (CVE-2026-33824). Unit 42 also notes it "reviewed evidence of batch exploitation against an unknown number of hosts that were listed in a file deleted by the actor prior to our analysis", so even the enumerated figures are a floor rather than a total. What survives from the original entry is its central reading of the autonomy question: Unit 42 attributes the confirmed compromises to the operator's manual work, and its table records the manual method against each of the four CVEs above, so the autonomous scanning component still did not itself produce the confirmed intrusions. What does not survive is the impact framing. A reader who took "three confirmed compromises, all NetScaler" from the original entry built the wrong exposure list, and the missing item is the awkward one: Marimo is an open-source reactive Python notebook that data-science and research teams install themselves, so it is far more likely to be absent from a central asset inventory than a NetScaler appliance is. **Defender takeaway:** re-run the exposure question against four products rather than one. NetScaler and Tomcat will be in the asset register; Marimo Notebook and self-managed IKE VPN endpoints frequently will not, and a notebook server is exactly the class of asset a research or analytics group stands up outside the change process. For marimo specifically the patch is old news — 0.23.0 shipped in April, the flaw is CISA KEV-listed, and it was covered here on 2026-05-30 — so the actionable half is not "patch it" but "find it, then check it": an instance still below 0.23.0 four months on is likely one nobody owns, and command execution confirmed on 11 endpoints means an exposed one should be treated as a compromise-assessment target, worked from the notebook host's process ancestry and outbound connections rather than from a version number. **Triage:** the discriminator for a notebook server is lineage rather than the process itself. A Marimo host legitimately spawns Python child processes constantly — that is what a notebook does — so process creation under the notebook service is noise. What is not noise is a child process that is not the interpreter: a shell, a download utility, or a scheduling command spawned by the notebook service account, especially on a host where no interactive session was open at that timestamp. Outbound connections from a notebook server to destinations outside the package-registry and data-source set it normally reaches are the second signal, and the two together — a non-interpreter child plus an unfamiliar egress destination within the same minute — are worth an alert on a host that was internet-reachable during the campaign window. ## Update — 2026-08-10T04:55:00Z The correction entry on the autonomous-agent intrusion campaign listed four CVEs the operation actually reached, and recorded this one only as "callbacks from three IKE VPN endpoints" — an observed effect with no mechanism behind it. 0patch has now published the root cause, which closes that gap ([0patch, 2026-08-05](https://0patch.com/blog/micropatches-released-for-windows-ike-service-extensions)). The analysis places CVE-2026-33824 as "a pre-authentication double free in ikeext.dll, the module behind the 'IKE and AuthIP IPsec Keying Modules' service, which runs as Local System inside a svchost.exe", with the flaw "in function IkeReinjectReassembledPacket, on the IKEv2 fragment reassembly path". An unauthenticated party who can reach UDP 500 or 4500 on a host acting as an IKEv2 responder can free the same heap block twice. 0patch's interest is not offensive — it "recreated a POC from the official patch" by diffing Microsoft's fix, in order to build micropatches for Windows versions no longer receiving official updates — but the consequence is that a working reproduction exists and its derivation is described. Microsoft's own record corroborates the surrounding facts without endorsing the function-level detail: CWE-415 double free, CVSS 9.8 with a network vector requiring no privileges and no user interaction, released 2026-04-14, and Microsoft's own summary that "An unauthenticated attacker could send specially crafted packets to a Windows machine with Internet Key Exchange (IKE) version 2 enabled, which could enable remote code execution" ([Microsoft Security Response Center, 2026-04-14](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824)). The affected range spans Windows Server 2016 through Windows Server 2025 and Windows 10 version 1607 through Windows 11 version 26H1 — effectively every supported release at the time — and the vendor records both exploitation and public disclosure as no. Two qualifications keep this proportionate. The service must be acting as an IKEv2 responder: Microsoft's own wording conditions the attack on IKE version 2 being enabled, so this is not every Windows host on the network, and its stated interim guidance is to block inbound UDP 500 and 4500 where IKE is unused and restrict it to known peers where it is required. And the campaign linkage is the tracked entry's, not 0patch's or Microsoft's — neither source makes any attribution claim, and neither states that the callbacks observed in that campaign resulted from this mechanism. Detection, telemetry class first. The exploitable surface is a UDP service, so network telemetry is where this lives: inbound sessions to UDP 500 or 4500 from sources outside the configured VPN peer set are the population to look at, and fragmented IKE negotiation traffic from an unrecognised peer is the specific shape, since the flaw sits on the fragment-reassembly path. On the host, the keying service crashing or restarting under svchost is the crash signature, and because the service runs as Local System, any child process descending from that svchost instance is anomalous. **Triage:** a host that legitimately terminates IPsec tunnels sees fragmented IKE traffic from its real peers constantly, so fragmentation alone is normal — the discriminator is the peer address, and secondarily fragment sequences that never complete a negotiation. **Defender takeaway:** the patch has existed since April, so the practical action is inventory rather than remediation — identify which Windows hosts are actually configured as IKEv2 responders, confirm they took the April 2026 update, and close UDP 500/4500 inbound on the ones that are not. This entry adds mechanism to a CVE the store already tracked as reached in a real campaign; it does not change its patch status. ## Update — 2026-08-19T04:45:00Z The double free in the Windows IKE and AuthIP IPsec Keying Modules service is now catalogued as exploited. CISA added CVE-2026-33824 to its Known Exploited Vulnerabilities catalog on 2026-08-18, recording it as a double free that "could enable remote code execution" ([CISA KEV catalog, 2026-08-18](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)), ENISA's EU Vulnerability Database carries the same 2026-08-18 date and an EPSS probability of 0.5585 for its corresponding record (EUVD renders this as the percentage 55.85), though as a mirror of CISA's determination rather than a second assessment of it ([ENISA EUVD, 2026-08-18](https://euvd.enisa.europa.eu/enisa/eu_vulnerability_database/EUVD-2026-22641)). The prior entry recorded this flaw as patched with exploitation reported as no; that is the part that changed, and it is the only part. The mechanism and the remediation are unchanged from the earlier coverage: the flaw sits on the IKEv2 fragment-reassembly path, needs no authentication and no user interaction, and yields code execution in the Local System context that hosts the IKEEXT service. What the exploitation confirmation changes is which hosts are in scope, because the vulnerable surface is not only the VPN concentrator — Microsoft's affected list spans Windows Server 2016 through 2025 and Windows 10 v1607 through Windows 11 v26H1, so any domain member that answers IKE, including a Routing and Remote Access role nobody remembers enabling, is a responder ([ENISA EUVD, 2026-08-18](https://euvd.enisa.europa.eu/enisa/eu_vulnerability_database/EUVD-2026-22641)). The sourcing split is itself the operationally useful part. Microsoft's record has not been revised since it was published on 14 April 2026, and it still records exploitation as no with an exploitability assessment of "Exploitation Less Likely" ([Microsoft Security Response Center, 2026-04-14](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824)). Any triage pipeline that ranks Windows CVEs on the vendor's own exploitability field — a common and otherwise reasonable design — has this flaw sitting four months deep in a patch backlog while two cataloguing authorities now class it as exploited. Neither authority publishes the telemetry behind its determination, and neither names an actor, so nothing here supports an attribution. Detection and hunting concentrate on the service rather than the packet, because the trigger is a malformed fragment sequence that no ordinary log records as anomalous. In process and service telemetry, the signals are unexpected termination, restart or crash-dump generation for the host process running the IKE and AuthIP IPsec Keying Modules service, and any child process created under it — that service should never spawn a command interpreter or a script host. In network telemetry, inbound UDP 500 and 4500 flows from source addresses outside the known VPN peer set are the exposure indicator, and fragmented IKE traffic volumes that do not match the peer population are worth a look. **Triage:** a legitimate IKEv2 negotiation produces the same port pair and the same fragmentation, so traffic shape alone does not discriminate — what separates suspicious from normal is the source address falling outside the configured peer set, and the correlation of that flow with a service fault or a new child process on the responder. Microsoft's own interim guidance is a firewall control rather than a configuration change: block inbound UDP 500 and 4500 where IKE is unused, and restrict them to known peers where it is required ([Microsoft Security Response Center, 2026-04-14](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824)). ## Correction — 2026-09-06T13:50:00Z The EPSS figure quoted twice for CVE-2026-33824 was ENISA's EU Vulnerability Database rendering, which expresses EPSS as a percentage rather than as the probability itself. EUVD's API returns the value multiplied by one hundred, so 55.85 is an exploitation probability of 0.5585 ([FIRST.org EPSS API, value as of 2026-08-18](https://api.first.org/data/v1/epss?cve=CVE-2026-33824&date=2026-08-18)). The point the passage makes, that EUVD mirrors CISA's determination rather than assessing it independently, is unaffected.