Your VPN gateway can be compromised before anyone logs in
Authentication is not the first thing an attacker reaches — the handshake is.
CVE-2026-33824 — CVSS 9.8 — a double free in the Windows IKE Service Extensions. Microsoft patched it in April 2026. CISA added it to the Known Exploited Vulnerabilities catalog on August 18, 2026, on evidence of active exploitation. Four months passed between the fix and the alarm.
WHAT ACTUALLY HAPPENED
The flaw sits in ikeext.dll, the library behind the IKEEXT service that terminates IPsec tunnels on Windows. During IKEv2 fragment reassembly, ownership of a heap-allocated blob pointer is handled incorrectly and the same memory is freed twice.
The delivery mechanism is crafted UDP packets sent to port 500, or 4500 with NAT traversal. That is all of it. No credentials, no valid VPN account, no user interaction, no phishing step.
Successful exploitation runs attacker code in the context of IKEEXT — a service that runs as SYSTEM.
Affected: Windows 10, 11 and Windows Server 2012 through 2025, wherever IPsec or an IKEv2 VPN is configured. That covers RRAS servers, Always On VPN endpoints, site-to-site tunnel terminators, and any host carrying an IPsec policy.
WHY PRE-AUTHENTICATION CHANGES THE MATH
Remote access security is built around the login. MFA, conditional access, certificate validation, device posture — every one of those runs after tunnel negotiation completes.
This bug executes during the negotiation. The entire identity stack sits downstream of the memory corruption and never gets a vote.
The exposure is structural, too. UDP 500 and 4500 face the internet by design on any tunnel endpoint, and on gateways serving roaming peers the firewall rule is usually "allow any source", because you cannot predict where a peer will connect from tomorrow.
WHAT TO DO NOW
VERIFY THE APRIL 2026 UPDATE ON EVERY TUNNEL ENDPOINT — a patch released is not a patch installed, and KEV listing means someone is already testing that difference.
RESTRICT UDP 500 AND 4500 TO KNOWN PEERS — site-to-site tunnels have fixed peer addresses; pin them and drop everything else at the edge.
FIND THE HOSTS YOU FORGOT TERMINATE IPSEC — legacy RRAS boxes and one-off tunnels to partners rarely appear in the VPN inventory, and they answer on 500 all the same.
HUNT FOR IKEEXT SERVICE CRASHES — unexplained restarts or crash dumps for that service are the cheapest early signal of failed exploitation attempts.
A vulnerability reachable before authentication makes your access policy irrelevant. The strongest login controls in the world never execute.
How many Windows hosts in your estate answer on UDP 500 right now — and when were they last patched?