Windows IKE RCE CVE-2026-33824 and AFD Zero-Day CVE-2026-68820: Exploited Windows Bugs, Summer 2026

Published 2026-10-08 · Last updated 2026-10-08

The three bugs

• CVE-2026-33824, IKE Service Extensions RCE. IKE is the key-exchange protocol behind IPsec VPNs and Windows’ built-in VPN/DirectAccess. A double free lets an unauthenticated attacker who can reach UDP 500/4500 run code on the machine. Microsoft patched it in April 2026. CISA added it to the exploited list in August, meaning attackers built a working exploit from the patch and are now using it on machines that never updated.
• CVE-2026-68820, WinSock driver EoP. A use-after-free in afd.sys, the kernel driver behind Windows networking sockets. It was exploited as a zero-day: malware already running as a normal user uses it to become SYSTEM.
• CVE-2026-56155, AD FS EoP. On servers running Active Directory Federation Services (the role that provides single sign-on for many on-prem and hybrid setups), coarse access control let an authenticated attacker escalate locally. Also a zero-day.

Am I affected?

Check the build with winver, or in PowerShell:

$v = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
"$($v.DisplayVersion)  build $($v.CurrentBuild).$($v.UBR)"

You’re covered for all three once you’re at or above the build in the right-hand column (the August 2026 fix for afd.sys is the newest):

Version	IKE fix (33824)	All three fixed
Windows 11 24H2 / 25H2	26100/26200.8246	26100/26200.9168
Windows 11 23H2	22631.6936	22631.7517
Windows 11 26H1	28000.1836	28000.2704
Windows 10 22H2 / 21H2	19045/19044.7184	19045/19044.7663
Windows Server 2025	26100.32690	26100.33296
Windows Server 2022	20348.5020	20348.5499
Windows Server 2019	17763.8644	17763.9121
Windows Server 2016	14393.9060	14393.9418

Server 2012 / 2012 R2 receive the afd.sys and AD FS fixes only with Extended Security Updates. Windows 10 likewise needs ESU (see the Windows 10 problem).

Is IKE even listening? On a server:

Get-NetUDPEndpoint -LocalPort 500,4500 -ErrorAction SilentlyContinue
Get-Service IKEEXT

How to patch

Install the latest cumulative update (any month from August 2026 onward includes all three fixes) and reboot. Prioritise:

1. Anything with UDP 500/4500 reachable from the internet: VPN servers, RRAS, DirectAccess, servers with a public IP.
2. AD FS servers.
3. Everything else.

Mitigations

• Block inbound UDP 500 and 4500 at the edge firewall for every host that isn’t an IPsec VPN endpoint. Most PCs and servers have no reason to accept IKE from the internet.
• If a server doesn’t use IPsec at all, the IKE and AuthIP IPsec Keying Modules service (IKEEXT) can be disabled. Test first, because some VPN and Always On VPN setups depend on it.
• For the two privilege-escalation bugs there’s no workaround; they’re only reachable once an attacker already runs code, so endpoint protection and least privilege are your buffer until you patch.

Sources

• Microsoft: CVE-2026-33824 · CVE-2026-68820 · CVE-2026-56155
• CISA Known Exploited Vulnerabilities catalog

← Back to Knowledge Base