For home users, this means that if a security update is available for their device, it should be installed as soon as possible. Organizations and system administrators should also check whether affected systems are accessible via the internet and whether there are any indications that an attack has already taken place on vulnerable devices.
Microsoft IKE: Critical vulnerability enables code execution
The first vulnerability is designated CVE-2026-33824 and affects the Internet Key Exchange (IKE) service extensions in Windows. It’s caused by a “double-free” error, where a memory block can be freed multiple times under certain conditions.
The vulnerability is classified as critical, with a CVSS score of 9.8 out of 10. An unauthenticated attacker can exploit it over the network and thereby execute their own code on an affected system.
Microsoft already patched this vulnerability with its April security update. Its inclusion in the CISA KEV catalog now…
