CVE-2026-33824: microsoft windows_10_1607, microsoft windows_10_1809, microsoft windows_10_21h2

CVSS 9.8 (critical) · listed as exploited by CISA since 2026-08-18 · published 2026-04-14

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

Affected products (NVD): microsoft windows_10_1607, microsoft windows_10_1809, microsoft windows_10_21h2, microsoft windows_10_22h2, microsoft windows_11_23h2, microsoft windows_11_24h2, microsoft windows_11_25h2, microsoft windows_11_26h1, microsoft windows_server_2016, microsoft windows_server_2019, microsoft windows_server_2022, microsoft windows_server_2022_23h2, microsoft windows_server_2025

Fixed in (NVD): 10.0.14393.9060, 10.0.17763.8644, 10.0.19044.7184, 10.0.19045.7184, 10.0.22631.6936, 10.0.26100.8246, 10.0.26200.8246, 10.0.28000.1836, 10.0.20348.5020, 10.0.25398.2274, 10.0.26100.32690

Weakness: CWE-415

Source: NVD CVE-2026-33824

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824
• https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33824

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.