Microsoft IKE Double Free Vulnerability: What Small Business Owners Must Do Now
Microsoft has disclosed CVE-2026-33824, a double free vulnerability in Internet Key Exchange (IKE) Service Extensions that allows attackers to execute arbitrary code remotely. CISA added this to its Known Exploited Vulnerabilities catalog just yesterday, which means threat actors are already weaponizing it. If you run Microsoft infrastructure—especially anything handling VPN or network authentication—you need to act today, not next week.
Why This Matters More Than the Headline Suggests
A double free vulnerability is nasty because it lets attackers corrupt memory in ways that crash systems or hand over complete control. What makes CVE-2026-33824 dangerous for your business is the vector: IKE Service Extensions are often exposed to networks you think are protected. Many small business owners assume their VPN gateways, site-to-site connections, or remote access infrastructure sit safely behind firewalls. They don't always, and attackers know it.
The real problem isn't understanding what a double free is—it's that most organizations don't inventory their IKE deployments properly. You might have these services running on servers you forgot about, or in cloud instances that were spun up for a specific project two years ago and never decommissioned. That detection-and-ownership gap is what gets exploited. CISA listed this vulnerability because it's already being attacked in the wild.
Three Actions to Take Right Now
Step 1: Find Every System Running IKE Service Extensions
Start with your network team or managed service provider. Ask specifically for any systems running Microsoft Internet Key Exchange Service Extensions. Check your VPN concentrators, remote access servers, Azure infrastructure, and any hybrid cloud setups. If you use a third-party security vendor, have them scan for exposed IKE services. Document what you find with IP addresses, patch levels, and whether each system is internet-facing. This isn't optional—you cannot patch what you don't know exists.
Step 2: Prioritize Based on Internet Exposure and Apply Microsoft's Updates
Not all systems are equally urgent. CISA's BOD 26-04 guidance tells you to patch internet-exposed assets first. If an IKE service is reachable from outside your network, it gets priority. Microsoft has released patches—apply them according to the vendor's instructions. If you're on cloud services, verify that your cloud provider has applied the mitigations and confirm it in writing. For systems you cannot patch immediately, consider taking them offline or isolating them at the network level until patches are available.
Step 3: Document What You Did and Plan for Continuity
Keep records of which systems you patched, when you patched them, and which systems required workarounds. If mitigations truly aren't available for a critical system, evaluate whether you can discontinue that product or replace it with an alternative. This isn't just compliance busywork—it's your proof that you responded professionally if you ever need to show an auditor or attorney what happened.
The Deadline Matters
CISA has set August 21, 2026 as the deadline for patching. That's two days away. This isn't a soft target. Treat it as your hard stop for having a mitigation plan in place on every affected asset.