TLP:CLEARSECURITY ADVISORYHRK-SA-2026-1104-19Exploited in the wild
Windows IKE RCE “BlueHammer” (CVE-2026-33824): zero-click code execution as SYSTEM
A double-free in the Windows IKE Extension lets an unauthenticated attacker run code as SYSTEM by sending crafted IKEv2 packets to a host with IPsec enabled, with no login and no user interaction. It scores 9.8, it is exploited in the wild against VPN gateways, and it is in CISA KEV. Apply the Windows update, then prove UDP 500 and 4500 are reachable only where they must be.
SEVERITY
Critical
PEAK CVSS
9.8
AUTH REQUIRED
None
PUBLIC POC
Reported
PUBLISHED
Nov 4, 2026
REVISION
v1.0 · @Melly
Hayrok Research highlight
The VPN gateway is the one box you deliberately expose to the whole internet, because that is its job. This flaw turns that exposure into a single-packet path to SYSTEM.
CVE-2026-33824, nicknamed BlueHammer, is a double-free in the Windows IKE Extension, the service that handles IPsec key exchange. An unauthenticated attacker sends crafted IKEv2 packets to UDP 500 or 4500, and code runs in the IKEEXT service, which carries SYSTEM-level privilege. No credentials. No click. Nothing for a user to fall for.
Microsoft patched it back in April, but CISA moved it to the Known Exploited Vulnerabilities catalog in August after a Chinese-speaking actor was seen manually exploiting it against VPN gateways, and it is still landing on unpatched edges. The lesson is the one defenders keep relearning: a patch released is not a patch running, and the assets most likely to be missed are the appliance-like Windows hosts at the edge that nobody reboots. Two questions settle it: is the fixed update actually live, and can anyone outside reach those two UDP ports.
01 · EXECUTIVE SUMMARY
Bottom line
Hayrok Research Lab is tracking a critical, unauthenticated remote code execution flaw in the Windows IKE Extension, nicknamed BlueHammer. A double-free (CWE-415) lets an attacker run code as SYSTEM by sending crafted IKEv2 packets, with no authentication and no user interaction. Microsoft fixed it in April 2026; CISA added it to KEV in August after confirmed exploitation against VPN gateways. The control is confirmed patch coverage on every IPsec-enabled Windows host, plus tight reachability on UDP 500 and 4500.
KEY JUDGMENTS
01
CISA added CVE-2026-33824 to its KEV catalog on Aug 18, 2026 after confirmed exploitation. Reporting attributes hands-on exploitation against VPN gateways to a Chinese-speaking actor.Observed
02
It affects all supported Windows 10, 11 and Windows Server releases where the IKE Extension processes IKEv2, typically hosts exposing UDP 500 or 4500.Reproduced
03
Code runs in the IKEEXT service context, which is SYSTEM-level, so a single successful packet is full host control with no further escalation needed.Assessed
04
Edge Windows hosts acting as VPN or IPsec gateways are the exposure, and they are exactly the appliance-like assets that lag on patching and reboots.Assessed
CWE-415 double free leading to remote code execution
Vector
UDP 500 / 4500, IKEv2, pre-auth, zero-click
Affected
All supported Windows 10, 11 and Windows Server with IKEv2 enabled
Scoring
9.8 · CVSS v3.1
Privilege
Code runs as the IKEEXT service (SYSTEM-level)
EXPOSURE: IPsec ENABLED AND REACHABLE
01Supported WindowsWindows 10, 11 or Server, unpatched.
02IKEv2 enabledThe IKE Extension processes IKEv2, often for VPN or IPsec.
03UDP 500 / 4500 reachableFrom a network an attacker can use.
04Edge roleVPN gateways and remote-access hosts are the priority.
03 · THREAT ACTIVITY
Exploitation status and timeline
IN THE WILDObservedKEV Aug 18; VPN gateways hit.
USER ACTIONNone neededZero-click, pre-auth.
PRIVILEGESYSTEM-levelRuns in the IKEEXT service.
PATCHAvailableApril 2026 Patch Tuesday.
DISCLOSURE AND ACTIVITY TIMELINE · 2026
Apr 14Microsoft fixes CVE-2026-33824 in the April 2026 Patch Tuesday, rated critical, 9.8.
Aug 18CISA adds CVE-2026-33824 to KEV after confirmed exploitation, with a short federal deadline.
ContextReporting attributes hands-on exploitation against VPN gateways to a Chinese-speaking threat actor; the flaw remains a live target on unpatched edges.
04 · AFFECTED PRODUCTS
Affected and fixed versions
The flaw spans the whole supported Windows family. Exposure is decided by whether the IKE Extension is handling IKEv2 and whether the ports are reachable, not by the edition alone.
PRODUCT
CONDITION
FIXED IN
STATUS
Windows 11 / 10
IKEv2 enabled, unpatched
April 2026 update
Fixed
Windows Server (all supported)
IKEv2 enabled, unpatched
April 2026 update
Fixed
Windows VPN / IPsec gateways
UDP 500/4500 exposed
April 2026 update, highest priority
Priority
Hosts with IKEv2 disabled
not processing IKEv2
lower exposure, still patch
Lower risk
COVERAGE IS THE RISKThe update shipped in April, so the failure mode now is an unpatched or unrebooted edge host. Confirm the fix is live on every IPsec-enabled Windows host, not just that it was approved.
05 · RECOMMENDED ACTIONS
What to do, in priority order
CriticalImmediately
Internet-facing Windows VPN or IPsec gatewaysConfirm the April 2026 update is installed and the host has rebooted. These are the hunted assets.
UDP 500 / 4500 exposed to untrusted networksRestrict reachability to intended peers while you confirm coverage.
HighWithin 72 hours
All supported Windows hostsConfirm the update across the fleet; every edition with IKEv2 is affected.
Hosts not using IPsecWhere IKEv2 is not needed, disable it to remove the attack surface.
MonitoringAlert on the IKEEXT service spawning processes, a strong exploitation signal.
HighBefore closing
Every hostRecord the installed update, reboot state and port reachability as evidence.
WORKAROUNDS
Patch and reboot. The April 2026 update is the fix. A patched host still needs the reboot to be protected.Restrict UDP 500 / 4500. Limit the IKE ports to intended VPN peers; drop them from untrusted networks.Disable IKEv2 where unused. If a host does not need IPsec, turning off the IKE Extension removes the surface.Alert on IKEEXT children. A service-hosted IKE process spawning a shell is a reliable exploitation signal.
06 · DETECTION AND HUNTING
Observables and hunting queries
This is a network-service RCE, so hunt on inbound IKE traffic from untrusted sources and on anomalous behavior of the IKEEXT service.
TYPE
OBSERVABLE
SOURCE
Request
Inbound UDP 500 or 4500 from outside RFC1918 to a Windows host
Firewall, NetFlow, packet capture
Behavior
The IKE service (IKEEXT.DLL, svchost) spawning processes
EDR, process creation (Sigma available)
Exposure
An IPsec-enabled Windows host missing the April 2026 update
Patch management, build inventory
HUNT · CVE-2026-33824IKE service spawning a child process
# Sigma: IKEEXT.DLL / svchost (IKEEXT) -> process creation
EXPOSURE · CVE-2026-33824external IKE traffic
# alert on inbound UDP 500/4500 from non-private source ranges
07 · MITRE ATT&CK
Technique mapping
TACTIC
ID
TECHNIQUE
BASIS
Initial Access
T1190
Exploit Public-Facing Application
Observed
Execution
T1059.001
Command and Scripting Interpreter (post-exploitation)
Assessed
08 · TECHNICAL ANALYSIS
Root cause and attack path
CVE-2026-33824 is a double-free (CWE-415) in the Windows IKE Extension, the component that implements Microsoft's additions to the Internet Key Exchange protocol used for IPsec. When the service processes certain malformed IKEv2 payloads, it frees the same memory twice, which an attacker shapes into controlled memory corruption and then code execution. The whole exchange happens during key negotiation, before any authentication, and needs no user interaction, which is why it is described as zero-click.
Code runs in the context of the IKEEXT service, which is SYSTEM-level, so a single successful packet is full control of the host rather than a foothold that still needs escalation. The reachable surface is any supported Windows system handling IKEv2, which in practice means VPN gateways and remote-access hosts exposing UDP 500 and 4500. Microsoft fixed it in April, but CISA's August KEV listing, after hands-on exploitation against VPN gateways, is the signal that matters: the flaw is being used against the edges that did not get patched or rebooted.
01 REACH
Attacker reaches UDP 500/4500 on a Windows IKE host
Cisco ASA/FTD VPN DoS. Another unauthenticated attack on the remote-access edge.
AssessedA zero-click, pre-auth path to SYSTEM on the box you expose on purpose. Patch coverage and port reachability are the only two questions that decide exposure.
09 · VALIDATION
Confirm remediation
An approved update is not a verdict. Each IPsec-enabled host should end with evidence: the April fix installed and the host rebooted, or the IKE ports unreachable from untrusted networks.
01
Inventory IPsec-enabled Windows hosts
Find every host where the IKE Extension handles IKEv2, especially VPN gateways.
This advisory will be updated as exploitation activity or vendor guidance changes.
12 · FAQ
Is CVE-2026-33824 being exploited?
Yes. CISA added it to the KEV catalog on August 18, 2026 after confirmed exploitation, and reporting attributes hands-on attacks against VPN gateways to a Chinese-speaking actor.
What privileges does an attacker gain?
Code runs in the IKEEXT service context, which is SYSTEM-level, so a single successful packet is full host control.
How is it reached?
By sending crafted IKEv2 packets to UDP 500 or 4500 on a Windows host with the IKE Extension enabled. No authentication or user interaction is needed.
I approved the April update. Am I safe?
Only if it is installed and the host has rebooted. The exposed, appliance-like edge hosts are the ones most often missed.
VALIDATE YOUR EXPOSURE
Prove your IPsec edge exposure
Hayrok inventories your IKEv2-enabled Windows hosts, confirms the update and reboot state, and tests whether UDP 500 and 4500 are reachable from untrusted networks. Every result lands in Evidence Fabric.