UPDATE — the root cause of CVE-2026-33824 is published: a pre-authentication double free on the IKEv2 fragment-reassembly path, reachable on UDP 500/4500 against any Windows IKEv2 responder
UPDATE · originally covered Correction — Unit 42's autonomous-agent campaign confirmed command execution on 11 Marimo notebook endpoints as well as three NetScaler exfiltrations (2026-08-02)
the correction entry on the autonomous-agent intrusion campaign listed four CVEs the operation actually reached, and recorded this one only as "callbacks from three IKE VPN endpoints" — an observed effect with no mechanism behind it. 0patch has now published the root cause, which closes that gap (0patch, 2026-08-05).
The analysis places CVE-2026-33824 as "a pre-authentication double free in ikeext.dll, the module behind the 'IKE and AuthIP IPsec Keying Modules' service, which runs as Local System inside a svchost.exe", with the flaw "in function IkeReinjectReassembledPacket, on the IKEv2 fragment reassembly path". An unauthenticated party who can reach UDP 500 or 4500 on a host acting as an IKEv2 responder can free the same heap block twice. 0patch's interest is not offensive — it "recreated a POC from the official patch" by diffing Microsoft's fix, in order to build micropatches for Windows versions no longer receiving official updates — but the consequence is that a working reproduction exists and its derivation is described.
Microsoft's own record corroborates the surrounding facts without endorsing the function-level detail: CWE-415 double free, CVSS 9.8 with a network vector requiring no privileges and no user interaction, released 2026-04-14, and Microsoft's own summary that "An unauthenticated attacker could send specially crafted packets to a Windows machine with Internet Key Exchange (IKE) version 2 enabled, which could enable remote code execution" (Microsoft Security Response Center, 2026-04-14). The affected range spans Windows Server 2016 through Windows Server 2025 and Windows 10 version 1607 through Windows 11 version 26H1 — effectively every supported release at the time — and the vendor records both exploitation and public disclosure as no.
Two qualifications keep this proportionate. The service must be acting as an IKEv2 responder: Microsoft's own wording conditions the attack on IKE version 2 being enabled, so this is not every Windows host on the network, and its stated interim guidance is to block inbound UDP 500 and 4500 where IKE is unused and restrict it to known peers where it is required. And the campaign linkage is the tracked entry's, not 0patch's or Microsoft's — neither source makes any attribution claim, and neither states that the callbacks observed in that campaign resulted from this mechanism.
Detection, telemetry class first. The exploitable surface is a UDP service, so network telemetry is where this lives: inbound sessions to UDP 500 or 4500 from sources outside the configured VPN peer set are the population to look at, and fragmented IKE negotiation traffic from an unrecognised peer is the specific shape, since the flaw sits on the fragment-reassembly path. On the host, the keying service crashing or restarting under svchost is the crash signature, and because the service runs as Local System, any child process descending from that svchost instance is anomalous. Triage: a host that legitimately terminates IPsec tunnels sees fragmented IKE traffic from its real peers constantly, so fragmentation alone is normal — the discriminator is the peer address, and secondarily fragment sequences that never complete a negotiation.
This is a pre-authentication double free in ikeext.dll, the module behind the "IKE and AuthIP IPsec Keying Modules" service, which runs as Local System inside a svchost.exe. The flaw is in function IkeReinjectReassembledPacket, on the IKEv2 fragment reassembly path.
We recreated a POC from the official patch, which allowed us to reproduce the issue and create patches
An unauthenticated attacker could send specially crafted packets to a Windows machine with Internet Key Exchange (IKE) version 2 enabled, which could enable remote code execution.
ATT&CK mapping
2 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Privilege Escalation TA0004
T1068Exploitation for Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Update chain
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.