CVE-2026-33824 — Windows IKE Extensions (IKEEXT) Double-Free Remote Code Execution HuntPack

CVE-2026-33824 is a critical (CVSS 9.8) double-free vulnerability (CWE-415) in the Windows IKE and AuthIP IPsec Keying Modules service extension (ikeext.dll, the IKEEXT service), reachable by sending specially crafted, fragmented IKEv2 packets to UDP port 500 or 4500 (NAT-T). Per Zero Day Initiative's technical writeup, IkeReinjectReassembledPacket() shallow-copies a Main Mode Security Association (MMSA) blob pointer (structure offset 0x208) into a stack variable while IkeQueueRecvRequest() deep-copies the reassembly buffer but not that pointer; the work-item thread's IkeDestroyPacketContext() frees the blob once, and a later IkeCleanupMMNegotiation() → IkeDerefMMSA() → IkeFreeMMSA() call frees the same allocation a second time. The trigger is a crafted IKE_SA_INIT message followed by two or more Encrypted Fragment (SKF) payloads containing an invalid IKE_AUTH message — no authentication and no user interaction are required, and because IKEEXT runs as SYSTEM, successful exploitation yields SYSTEM-level remote code execution. Microsoft patched it in the April 2026 security update cycle (ZDI disclosure 2026-04-22).

On 2026-08-18, CISA added CVE-2026-33824 to the Known Exploited Vulnerabilities (KEV) catalog with a short (3-day) federal remediation deadline. The trigger was Palo Alto Networks Unit 42's report "Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks", which documents a Zhuhai, China-based actor (aliases knaithe / KnYuan) who, as part of a broader campaign combining autonomous DeepSeek/Hermes-Agent-driven exploitation with hands-on-keyboard activity, manually sent reverse-shell callback attempts against three internet-facing IKE VPN endpoints using this CVE. Unit 42 is explicit that this activity was manual, separate from the actor's autonomous-AI attempts against other CVEs, and the campaign-wide "460+ targets" figure is not the CVE-2026-33824 victim count — only 3 endpoints were targeted through this flaw.

Exploitation is four months after patch availability, meaning every internet-reachable Windows IKE responder (RRAS/IKEv2 VPN gateway, IPsec-secured server-to-server link, DirectAccess/Always On VPN server) still running an unpatched build is at immediate risk. The CVSS vector (AV:N/AC:L/PR:N/UI:N) places this in the same wormable class as EternalBlue/BlueKeep-style flaws, though no self-propagating/worm activity has been observed in the wild as of 2026-08-20 — only the three manually-targeted endpoints reported by Unit 42.

Defender priority: Patch every Windows host that runs an IKE responder role immediately, then hunt for the exploitation signature: unexpected restarts of the svchost.exe process hosting IKEEXT, crash/fault telemetry referencing ikeext.dll, an unexpected child process spawned from that svchost.exe, and any outbound connection from that process or its child (the reverse-shell pivot).

IOC provenance note: No atomic IOCs (source IPs, callback destinations, or file hashes) have been publicly disclosed for the in-the-wild IKE exploitation as of 2026-08-20. Unit 42's own report describes the IKE activity as manual reverse-shell attempts against three endpoints but publishes no IKE-specific indicators; the IOCs it does publish (AI-model API and proxy hosts plus Telegram C2) belong to the actor's broader AI-tooling infrastructure, not confirmed IKE callback infrastructure. Gridinsoft's analysis independently confirms: "the public evidence confirms attempts to obtain a reverse shell, but it does not provide a unique IKE-specific file hash, process name, or complete victim count." This pack is therefore intentionally behavioral. Every IOC-appendix atomic field ships as a labelled REPLACE_WITH_… placeholder — nothing is fabricated.

Sources deliberately not used: the task-supplied SentinelOne URL for CVE-2026-68820 was verified to be a different, unrelated CVE and was not used; the correct CVE-2026-33824 SentinelOne URL was located and used instead. CVE-2026-68820 (Lazarus / AFD.sys / Operation Dream Job) is a separate, already-published HuntPack and is not referenced here.

Carry-forward decision: Build a behavioral pack anchored on the ZDI root-cause writeup (which process/DLL/service is involved and why it crashes) and the Unit 42 primary source (confirms manual reverse-shell exploitation against 3 endpoints, no atomic IOCs). No third-party indicator is imported as fact.

Hunt hypotheses (ordered by fidelity)

1. H1 (high): The svchost.exe process hosting IKEEXT (command line contains -s IKEEXT) launches/restarts more than once on a host outside of a normal boot — the Service Control Manager auto-restarting a service whose host process just crashed is the earliest, lowest-cost signal of an exploitation attempt (successful or failed).
2. H2 (high): A child process is spawned from the IKEEXT-hosting svchost.exe — in benign operation this service never spawns child processes, so any child process is a strong RCE/pivot signal.
3. H3 (high): The IKEEXT-hosting svchost.exe process itself opens an outbound network connection — possible in-process reverse-shell callback without a distinct child process.
4. H4 (high): A process that is a child of the IKEEXT-hosting svchost.exe opens an outbound network connection — the two-hop reverse-shell chain matching Unit 42's "manually sent reverse-shell callback" description.
5. H5 (medium, native only): Windows Security log records repeated IPsec Main Mode negotiation failures (Event ID 4653) from a single external source — the network-level probing/exploitation signature. Falcon EDR does not parse IKE protocol payloads, so this is a native audit-log hunt, not a CQL query.
6. H6 (medium, native only): Windows System log records Service Control Manager crash events (7031/7034) for IKEEXT, or Application log records a WER crash (Event ID 1000/1001) with faulting module ikeext.dll — the most direct native crash signature.
7. H7 (medium): Post-compromise persistence — a service or scheduled task is created by a process descending from the compromised IKEEXT svchost.exe shortly after the crash/restart window.
8. H8 (scoping, not an attack signal): Attack-surface baseline — identify which hosts have an active listener on UDP 500/4500 to prioritize patching and hunting.

Attack chain

No public atomic IOCs for the in-the-wild IKE exploitation. No source reviewed for this pack publishes an attacker source IP, reverse-shell callback IP/domain, or file hash tied specifically to the CVE-2026-33824 exploitation against the three Unit 42-observed endpoints. Per this pack's provenance rule, nothing is fabricated. The rows below are behavioral / log-based — that is the available hunt surface today.

If your own IR produces a verified reverse-shell destination or dropped-tool hash from an actual CVE-2026-33824 exploitation event, add it to the Falcon IOC-Management CSV in §10 with action=detect and a documented expiry — but only from first-party evidence.

Prerequisite: §8 CQL queries Q1–Q4 assume Falcon sensor coverage on the IKE-capable host itself. §7 native hunts (Windows Event Log) require IPsec Main Mode auditing to be explicitly enabled (it is not on by default) before Event ID 4653 will populate.

Falcon EDR does not parse IKE protocol payloads, so the network-level probing signature and the most direct crash signature live in native Windows Event Log channels. Run these on candidate IKE-responder hosts, or ship the channels below to your SIEM.

7.1 — Enable and hunt IPsec Main Mode negotiation failures (network-level probing signal)

Enable auditing (off by default):
  auditpol /set /subcategory:"IPsec Main Mode" /success:enable /failure:enable
  auditpol /set /subcategory:"IPsec Extended Mode" /success:enable /failure:enable

Hunt (Windows Security log):
  Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4653} |
    Select TimeCreated, Message

Review the source address and negotiation-failure reason for each hit.
Many failures from one external source in a short window = probing or
active exploitation attempts against the IKE responder.

7.2 — IKEEXT service crash / restart (System log)

Get-WinEvent -FilterHashtable @{LogName='System'; Id=7031,7034} |
  Where-Object { $_.Message -match 'IKEEXT' } |
  Select TimeCreated, Id, Message

Event ID 7031: "The IKEEXT service terminated unexpectedly."
Event ID 7034: "... This has happened N time(s)." (repeat-crash counter
is itself a strong exploitation-attempt signal — legitimate services
essentially never crash-loop.)

7.3 — Application crash referencing ikeext.dll (Windows Error Reporting)

Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1000,1001} |
  Where-Object { $_.Message -match 'ikeext\.dll' } |
  Select TimeCreated, Id, Message

Event ID 1000 (Application Error) with Faulting module name = ikeext.dll
and Faulting application = svchost.exe is the single highest-fidelity
native signature that the double-free was actually triggered on this host.

7.4 — Perimeter / NGFW cross-check

If your perimeter firewall/NGFW/IDS vendor has published or auto-updated
an IPS/IDS signature for CVE-2026-33824 since the 2026-08-18 KEV addition,
enable it and cross-reference hits against §7.1/7.2/7.3 on the same host
and time window. Vendor coverage is not verified in this pack — check with
your specific perimeter vendor.

Automation stitch: alert the SOC in real time on any Event ID 7034 (repeat IKEEXT crash) or Event ID 1000 with faulting module ikeext.dll, even before the host's logs reach a SIEM.

All queries below run against Falcon EDR endpoint telemetry. Windows builds shared-service hosts, so svchost.exe -s IKEEXT is the identifying command-line signature; on very low-memory/legacy configurations Windows may share IKEEXT in a multi-service svchost.exe group, which changes the command-line shape — validate the exact command line in your fleet before deploying.

// HUNT: IKEEXT-hosting svchost.exe restarts more than once (crash-restart signature)
// MITRE: T1190, T1210
// CONF: high  FP: medium  COST: low | REQUIRES: Falcon EDR ProcessRollup2
// FALSE POSITIVES: host reboot, patch-driven service restart, deliberate admin restart
// TUNING: exclude the first 5 minutes after host boot; exclude known patch-window hosts/times
#event_simpleName=/^ProcessRollup2$/
| FileName=/^svchost\.exe$/i
| CommandLine=/-s\s+IKEEXT/i
| groupBy([aid, ComputerName, CommandLine], function=([count(TargetProcessId, as=launches, distinct=true), collect(@timestamp, limit=5)]))
| rename(field=@timestamp, as=launchTimes)
| launches >= 2
| table([ComputerName, aid, CommandLine, launches, launchTimes], limit=200)

// HUNT: child process spawned from the IKEEXT-hosting svchost.exe
// MITRE: T1210, T1059.001, T1059.003
// CONF: high  FP: low  COST: medium | REQUIRES: Falcon EDR ProcessRollup2
// FALSE POSITIVES: shared svchost service-group edge cases on legacy/low-RAM builds
// TUNING: confirm -s IKEEXT is isolated (not grouped) in your fleet's svchost split before alerting
#event_simpleName=ProcessRollup2
| FileName=/^svchost\.exe$/i
| CommandLine=/-s\s+IKEEXT/i
| rename(field=TargetProcessId_decimal, as=ParentProcessId_decimal)
| join(query={#event_simpleName=ProcessRollup2}, field=[aid, ParentProcessId_decimal], include=[FileName, CommandLine, TargetProcessId_decimal, ImageFileName, @timestamp])
| table([ComputerName, aid, FileName, CommandLine, ImageFileName, TargetProcessId_decimal, @timestamp], limit=200)

// HUNT: outbound connection from the IKEEXT-hosting svchost.exe process itself
// MITRE: T1071, T1219, T1055
// CONF: high  FP: low  COST: medium | REQUIRES: Falcon EDR ProcessRollup2, NetworkConnectIP4
// FALSE POSITIVES: shared svchost service-group edge cases on legacy/low-RAM builds
// TUNING: confirm -s IKEEXT is isolated (not grouped) in your fleet's svchost split before alerting
#event_simpleName=ProcessRollup2
| FileName=/^svchost\.exe$/i
| CommandLine=/-s\s+IKEEXT/i
| rename(field=TargetProcessId_decimal, as=ContextProcessId_decimal)
| join(query={#event_simpleName=NetworkConnectIP4}, field=[aid, ContextProcessId_decimal], include=[RemoteAddressIP4, RemotePort, LocalPort, Protocol_decimal, @timestamp])
| table([ComputerName, aid, RemoteAddressIP4, RemotePort, LocalPort, @timestamp], limit=200)

// HUNT: outbound connection from a child process of the IKEEXT-hosting svchost.exe (reverse-shell chain)
// MITRE: T1210, T1059, T1071, T1219
// CONF: high  FP: low  COST: high | REQUIRES: Falcon EDR ProcessRollup2, NetworkConnectIP4
// FALSE POSITIVES: shared svchost service-group edge cases on legacy/low-RAM builds
// TUNING: scope to a 7-30d window before running fleet-wide; confirm -s IKEEXT isolation in your build
#event_simpleName=ProcessRollup2
| FileName=/^svchost\.exe$/i
| CommandLine=/-s\s+IKEEXT/i
| rename(field=TargetProcessId_decimal, as=ParentProcessId_decimal)
| join(query={#event_simpleName=ProcessRollup2}, field=[aid, ParentProcessId_decimal], include=[TargetProcessId_decimal, FileName, CommandLine])
| rename(field=TargetProcessId_decimal, as=ContextProcessId_decimal)
| join(query={#event_simpleName=NetworkConnectIP4}, field=[aid, ContextProcessId_decimal], include=[RemoteAddressIP4, RemotePort, @timestamp])
| table([ComputerName, aid, FileName, CommandLine, RemoteAddressIP4, RemotePort, @timestamp], limit=200)

// HUNT: hosts listening on UDP 500/4500 (IKE attack-surface baseline)
// MITRE: T1190, T1210 (exposure context)
// CONF: medium (scoping query, not an attack signal)  FP: n/a  COST: low | REQUIRES: Falcon EDR NetworkListenIP4
// FALSE POSITIVES: n/a — this is an inventory query
// TUNING: none required; re-run periodically as fleet composition changes
#event_simpleName=NetworkListenIP4
| in(LocalPort, values=[500, 4500])
| table([ComputerName, aid, LocalAddressIP4, LocalPort, @timestamp], limit=200)

// HUNT: sc.exe/schtasks.exe create spawned from a child of the IKEEXT-hosting svchost.exe
// MITRE: T1543.003, T1053.005
// CONF: medium  FP: low  COST: medium | REQUIRES: Falcon EDR ProcessRollup2
// FALSE POSITIVES: none expected; flag any hit as a confirmed persistence event
// TUNING: extend the join depth if attackers proxy through an extra hop (e.g. cmd.exe /c)
#event_simpleName=ProcessRollup2
| FileName=/^svchost\.exe$/i
| CommandLine=/-s\s+IKEEXT/i
| rename(field=TargetProcessId_decimal, as=ParentProcessId_decimal)
| join(query={#event_simpleName=ProcessRollup2}, field=[aid, ParentProcessId_decimal], include=[TargetProcessId_decimal, FileName, CommandLine])
| rename(field=TargetProcessId_decimal, as=ParentProcessId_decimal)
| join(query={#event_simpleName=ProcessRollup2}, field=[aid, ParentProcessId_decimal], include=[FileName, CommandLine, @timestamp])
| FileName=/^(sc|schtasks)\.exe$/i
| CommandLine=/(create|config|\/create)/i
| table([ComputerName, aid, FileName, CommandLine, @timestamp], limit=200)

Promote the highest-confidence, lowest-FP endpoint hunts to Custom IOAs. Q5 (exposure baseline) stays a scheduled scoping search, not an IOA.

Pilot every IOA in Monitor for 7–14 days on your IKE-capable host population and confirm the shared-svchost-group exclusion is correct for your Windows builds before promoting to Detect/Block.

Behavioral pack — no atomic IOCs published for the IKE exploitation. The CSV below ships with REPLACE_WITH_… placeholders only. Populate it solely from first-party evidence (your own IR / confirmed exploitation). Do not import the AI-tooling infrastructure IOCs from Unit 42's report (the AI-model API and proxy hosts named in section 2) as IKE-specific — Unit 42 does not attribute those to the IKE reverse-shell activity.

type,value,action,severity,expiration,description,tags
ipv4,REPLACE_WITH_ATTACKER_SOURCE_IP,detect,high,2027-02-20,CVE-2026-33824 IKE exploitation source (first-party),cve:CVE-2026-33824
ipv4,REPLACE_WITH_C2_CALLBACK_IP,detect,critical,2027-02-20,CVE-2026-33824 reverse-shell callback dest (first-party),cve:CVE-2026-33824
domain,REPLACE_WITH_C2_CALLBACK_DOMAIN,detect,critical,2027-02-20,CVE-2026-33824 reverse-shell callback domain (first-party),cve:CVE-2026-33824
sha256,REPLACE_WITH_REVERSE_SHELL_BINARY_HASH,detect,critical,2027-02-20,post-exploitation tool dropped via CVE-2026-33824 (first-party),cve:CVE-2026-33824
# No public IOC disclosed as of 2026-08-20. Leave rows blank/unused unless
# YOUR OWN telemetry confirms them. Populate from your own Unit 42 threat-intel
# feed or observed exploitation only — never from third-party recycling.

ipsec_mm_fail   Security log, EventID 4653 (IPsec Main Mode negotiation failed)
svc_crash       System log, EventID 7031/7034, message contains "IKEEXT"
wer_crash       Application log, EventID 1000/1001, faulting module ikeext.dll
faulting_proc   Faulting application = svchost.exe (paired with wer_crash)

restart     svchost.exe -s IKEEXT launches >=2x outside boot window   (Q1)
child_proc  any child of the IKEEXT-hosting svchost.exe                (Q2)
out_conn    IKEEXT svchost.exe itself opens outbound connection        (Q3)
rev_shell   child of IKEEXT svchost.exe opens outbound connection      (Q4)
persist     sc.exe/schtasks.exe descending from IKEEXT svchost.exe     (Q6)

Verify build against Microsoft's official Security Update Guide entry
for CVE-2026-33824 (fixed in the April 2026 cycle) — do not assume a
build number without checking your specific Windows branch.

  Get-CimInstance Win32_OperatingSystem | Select Version, BuildNumber

Identify exposed IKE responders:
  Get-NetFirewallRule | Where-Object {$_.Enabled -eq 'True'} |
    Get-NetFirewallPortFilter | Where-Object {$_.LocalPort -in 500,4500}

Service state:
  Get-Service IKEEXT | Select Status, StartType

13.1 — Verify patch level and enable IPsec Main Mode auditing (PowerShell)

# Verify build (compare against Microsoft's Security Update Guide entry
# for CVE-2026-33824 for your specific Windows branch — do not assume):
Get-CimInstance Win32_OperatingSystem | Select-Object Version, BuildNumber

# Enable IPsec Main Mode / Extended Mode auditing (off by default):
auditpol /set /subcategory:"IPsec Main Mode" /success:enable /failure:enable
auditpol /set /subcategory:"IPsec Extended Mode" /success:enable /failure:enable

# Verify:
auditpol /get /subcategory:"IPsec Main Mode"

Prerequisites: local administrator rights on the target host. Reboot required: No. Rollback: auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable (and the same for Extended Mode) to restore the prior (default-off) audit state.

13.2 — Restrict UDP 500/4500 to known VPN peers (Windows Firewall)

# Only run on hosts where the legitimate VPN client/peer range is known.
# Replace the placeholder CIDR with your actual VPN client pool / peer range.
New-NetFirewallRule -DisplayName "CVE-2026-33824 — Restrict IKE to known peers" `
  -Direction Inbound -Protocol UDP -LocalPort 500,4500 `
  -RemoteAddress REPLACE_WITH_KNOWN_VPN_CLIENT_CIDR -Action Allow -Profile Any

# Verify the rule and confirm no broader "Allow Any" IKE rule remains enabled
# alongside it (an existing permissive rule will make this addition a no-op):
Get-NetFirewallRule -DisplayName "CVE-2026-33824*" | Get-NetFirewallPortFilter
Get-NetFirewallRule | Where-Object {$_.Enabled -eq 'True'} |
  Get-NetFirewallPortFilter | Where-Object {$_.LocalPort -in 500,4500}

Prerequisites: local administrator rights; an accurate, documented list of legitimate VPN client/peer source ranges (getting this wrong breaks remote access). Reboot required: No. Rollback: Remove-NetFirewallRule -DisplayName "CVE-2026-33824 — Restrict IKE to known peers", then re-confirm the previously existing IKE firewall rule (if any) is back to its documented prior state.

13.3 — Collect IKEEXT crash artifacts for IR (PowerShell, read-only)

Get-WinEvent -FilterHashtable @{LogName='System'; Id=7031,7034} |
  Where-Object { $_.Message -match 'IKEEXT' } |
  Export-Csv -Path .\ikeext_scm_crashes.csv -NoTypeInformation

Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1000,1001} |
  Where-Object { $_.Message -match 'ikeext\.dll' } |
  Export-Csv -Path .\ikeext_wer_crashes.csv -NoTypeInformation

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4653} |
  Export-Csv -Path .\ipsec_mm_failures.csv -NoTypeInformation

Prerequisites: local administrator or event-log read rights; IPsec Main Mode auditing enabled (13.1) for the third export to return data. Reboot required: No. Rollback: none required — this is a read-only evidence-collection step.

13.4 — Emergency mitigation: disable IKEEXT on hosts confirmed not to need IPsec/VPN

# Only run after confirming the host does NOT provide IPsec/VPN service —
# this will break any active or future IKE/IPsec negotiation on the host.
Stop-Service IKEEXT -Force
Set-Service IKEEXT -StartupType Disabled

# Verify:
Get-Service IKEEXT | Select-Object Status, StartType

Prerequisites: confirmed, documented evidence the host does not require IPsec/IKEv2 VPN functionality; local administrator rights. Reboot required: No, but any active VPN/IPsec session on the host will drop immediately. Rollback: Set-Service IKEEXT -StartupType Manual; Start-Service IKEEXT (or restore the host's prior documented startup type if it was not Manual).

13.4 is a breaking change if applied to a host that does need IPsec/VPN — confirm scope with the §5 affected-surface matrix before running it broadly.

Validation: Coverage is strongest on the post-exploitation pivot (child process, outbound connection, reverse-shell chain, persistence — Q2/Q3/Q4/Q6), which matches exactly what Unit 42 reported observing. Coverage is weakest on the network-level exploit trigger itself (fragmented IKEv2 packets) because Falcon EDR does not parse that protocol — §7 native Windows Event Log hunts and perimeter IPS/NGFW signatures are required to close that gap.

Provenance statement: This pack contains zero atomic IOCs for the in-the-wild IKE exploitation. Every detection signature traces to the ZDI root-cause writeup (Tier 1), the Unit 42 primary source (Tier 1), or documented behavioral guidance in Tier 2 sources. The task-supplied SentinelOne URL for the unrelated CVE-2026-68820 was identified as incorrect and not used; the correct CVE-2026-33824 SentinelOne page was located and used instead. All 6 sources above have fetched-text snapshots saved alongside this file for the IOC-provenance validation gate.