4 Windows Zero-Days Exploited Aug-Sep 2026 with IKE CVE-2026-33824

While going through CISA's KEV catalog, I noticed Windows entries appearing frequently during Aug. to Sep. 2026, so I pulled MSRC's CVRF data for Apr., Aug. and Sep. and compared each entry with KEV. Most news reports cover them separately, but anyone administering these machines needs to know which patch each one requires and which versions are affected.

4 vulnerabilities were listed as exploited in the wild.

CISA lists ransomware use as Unknown for all 4. The base CVSS scores match those listed by NVD, while the sources I read provide no details about who is attacking or whom they are targeting.

IKE is the most concerning, CVE-2026-33824

This one requires no attacker account and no user interaction. MSRC explains that an attacker can send specially crafted packets to a Windows machine with IKE version 2 enabled and execute code on it (AV:N/AC:L/PR:N/UI:N). Microsoft rates it Critical.

What I consider important is the timeline. The patch was released on Apr. Patch Tuesday, but CISA only added it to KEV on 18 Aug. I interpret this as attacks against machines still missing the Apr. patch, roughly 4 months after its release (CISA does not specify what kinds of machines were targeted; this is my own conclusion).

There is a discrepancy between the two sources. The MSRC CVRF data I retrieved on 5 Nov. still lists this CVE's exploitability as Exploited:No and Exploitation Less Likely, even though KEV lists it as exploited. I follow KEV because its entries are based on evidence of exploitation. Microsoft revised this CVE's page on 20 Aug. to expand the workaround description (version 1.1). These dates are a reminder that the assessment label at disclosure is no guarantee.

Who uses IKE, and workarounds IKE is the protocol used to negotiate IPsec keys. Common examples on Server include IKEv2 and L2TP/IPsec VPNs, site-to-site VPNs and machines with connection security rules configured (this is my own summary; Microsoft only specifies that IKEv2 must be enabled). Check whether the machine is listening on these ports.

Get-Service -Name IKEEXT | Format-List Name, Status, StartType
Get-NetUDPEndpoint -LocalPort 500, 4500 -ErrorAction SilentlyContinue | Format-Table LocalAddress, LocalPort, OwningProcess

Microsoft published 2 workarounds: if the machine does not use IKE, block inbound UDP 500 and 4500; if it does, allow only known peers. Microsoft explicitly states that these reduce the attack surface but do not replace patching.

# เครื่องที่ไม่ใช้ IKE: บล็อกขาเข้า (ชั่วคราว ถอดออกหลังลงแพตช์)
New-NetFirewallRule -DisplayName 'Temp block IKE inbound' -Direction Inbound -Protocol UDP -LocalPort 500,4500 -Action Block

# เครื่องที่ต้องใช้ IKE: เปิดเฉพาะ peer ที่รู้จัก (203.0.113.10 เป็นค่าตัวอย่าง)
New-NetFirewallRule -DisplayName 'IKE from known peer' -Direction Inbound -Protocol UDP -LocalPort 500,4500 -RemoteAddress 203.0.113.10 -Action Allow

The other 3 are local privilege escalation vulnerabilities

All three require the ability to run programs on the machine beforehand. The result is SYSTEM privileges. The machines most at risk are those that allow multiple people to log in (RDS, jump hosts, build machines), or machines hosting web apps with command execution vulnerabilities, because these privilege escalation vulnerabilities turn an ordinary user-level foothold into control of the entire machine.

• CVE-2026-68820 (AFD for WinSock) requires winning a race condition (AC:H). The attacker runs a specially crafted application. It affects Server 2012 through 2025 and Windows 10/11.
• CVE-2026-85880 (ALPC) Microsoft's FAQ states that an attacker running code in a low-privilege AppContainer can use this vulnerability to escape the sandbox and elevate privileges. Server 2012 through 2022 are listed; Server 2025 is not listed.
• CVE-2026-81963 (Windows Update Stack) is a link following vulnerability in an update component. Only Server 2025 and Windows 11 are listed in the CVRF data.

KBs to install and build checks

If a machine is at the build listed below or newer, all four vulnerabilities applicable to that version are fixed (cumulative updates include previous fixes). For the "minimum build," I took the highest build among the patches applicable to that version.

1. Identify machines with IKE enabled using the two commands above. VPN machines and gateways come first.
2. Apply workarounds on machines that cannot be patched yet (block or restrict peers).
3. Install the latest cumulative update for the versions in the table, one machine at a time, starting with machines that allow multiple people to log in.
4. Restart and check the build using the script below.
5. Remove temporary rules after confirming the build meets the requirement, so the VPN does not break when someone changes the configuration later.

For Server 2022 Datacenter: Azure Edition with hotpatch, the Aug. fix is KB5120229 (build 20348.5440), according to CVRF. Check the hotpatch entry separately.

# ใช้กับ Windows Server เท่านั้น ค่าคือ build ขั้นต่ำที่ครอบคลุมทั้ง 4 CVE ตามตารางด้านบน
$cv  = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
$min = @{ '9200' = 26349; '9600' = 23398; '14393' = 9512; '17763' = 9245; '20348' = 5622; '26100' = 33438 }
$b = [string]$cv.CurrentBuildNumber
if ($min.ContainsKey($b) -and $cv.UBR -ge $min[$b]) { "OK  $b.$($cv.UBR)" } else { "WARN  $b.$($cv.UBR) ต่ำกว่า Sep 2026" }
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID, InstalledOn

Check whether you have already been compromised

Microsoft's CVRF data contains no IOCs for these 4 vulnerabilities, so I have no search checklist to provide. For IKE, all I can suggest is checking whether the machine accepted UDP 500/4500 directly from the internet during Apr. to Aug. For the other three, check for low-privilege accounts or processes running unusual tasks as SYSTEM. This is my own heuristic, not official IOCs.

Personally, if I had an IKEv2 VPN machine exposed directly to the internet with a build below the table, I would patch it during the earliest available maintenance window and would not postpone it beyond that window. In the meantime, I would apply workarounds to machines that do not serve as VPNs. The other three privilege escalation vulnerabilities can be patched on the regular schedule, but I would prioritize machines that allow multiple people to log in, based on the risks in each environment.

P.S. I will no longer use the "Exploitation Less Likely" label as a reason to postpone a Critical patch that requires no login, because this IKE vulnerability shows that the label does not hold indefinitely.

Sources: Microsoft MSRC CVRF for Apr., Aug., Sep. 2026 (https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Apr, https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Aug, https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Sep), CISA KEV (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-33824), Microsoft Support KB5120242 (https://support.microsoft.com/help/5120242), KB5122882 (https://support.microsoft.com/help/5122882), KB5122871 (https://support.microsoft.com/help/5122871), KB5120229 (https://support.microsoft.com/help/5120229). Information current as of 5 Nov. 2026. I will come back and update this later.