Loading story…
Microsoft has disclosed CVE-2026-33824, a remote code execution vulnerability in Windows Internet Key Exchange (IKE) Service Extensions, prompting calls for rapid patching of systems that rely on IPsec for VPNs, secure tunnels, and trust relationships. The flaw affects a core Windows networking component commonly exposed on servers, gateways, and other perimeter-facing assets, raising concern that externally reachable hosts could be targeted first even though public technical details remain limited.
Reporting on the advisory says defenders should not treat the sparse disclosure as low risk, because Microsoft’s confidence assessment indicates the vendor considers the issue credible and actionable. Security teams are being urged to inventory IKE- and IPsec-dependent systems, prioritize internet-facing devices for remediation, apply Microsoft updates quickly, and verify that tunnels and authentication workflows continue to function after patching, amid broader concern that attackers can use advisory details to begin probing and reverse engineering vulnerable services.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft issued advisory information for CVE-2026-33824, a remote code execution vulnerability affecting Windows Internet Key Exchange (IKE) Service Extensions, prompting defenders to prioritize patching of exposed IPsec and VPN-related systems.
CVE-2021-31206 was identified during the 2021 Pwn2Own contest as a remote code execution vulnerability affecting Microsoft Exchange Server.
Microsoft disclosed CVE-2021-31206 in its Security Update Guide and made an official fix available, stating the flaw was not publicly disclosed and not exploited in the wild at publication.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
windowsforum.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
bjCSIRT issued an alert for a **remote code execution** vulnerability affecting extensions of the Windows Internet Key Exchange (IKE) service. Successful exploitation could allow an unauthenticated attacker to execute code on exposed Windows systems, making rapid identification of affected IKE-enabled hosts and application of Microsoft security updates a priority. Microsoft has also reported that its multi-model agentic security system identified 16 previously unknown vulnerabilities, illustrating expanded AI-assisted vulnerability discovery across software ecosystems. Security teams should review Microsoft and national-CSIRT advisories for the affected IKE extension, prioritize remediation based on internet exposure, and restrict IKE services to required, trusted network paths until patches are deployed.
Aug 26, 2026
Microsoft’s June 2026 Patch Tuesday delivered a record-setting security release, with reports citing **206 to 208 CVEs** addressed across Windows, Office, Azure, SQL Server, and other products, including **32 critical** issues. Among the most urgent were multiple **Remote Desktop Client** remote code execution flaws—`CVE-2026-42985`, `CVE-2026-47289`, `CVE-2026-44801`, `CVE-2026-44799`, and `CVE-2026-48563`—that could let an attacker run code on a victim system if the user connected to a malicious Remote Desktop Server or accepted a specially crafted RDP certificate. Microsoft rated `CVE-2026-42985` as **more likely** to be exploited, while the others were assessed as less likely at publication; several of the bugs were credited to Kyeongmin Kim of KAIST Hacking Lab. Microsoft also disclosed **`CVE-2026-47291`**, a critical **HTTP.sys** remote code execution vulnerability with a **CVSS 9.8** score that can be exploited remotely without authentication or user interaction by sending a specially crafted packet to a server using the Windows HTTP Protocol Stack. Microsoft said systems using the default `MaxRequestBytes` setting are not affected, but warned that servers with higher values may be vulnerable and advised administrators to set the registry value to a safe level and restart the HTTP service or host until patches are applied. Cisco Talos published Snort coverage for many of the newly disclosed flaws, while separate reporting also highlighted one actively exploited zero-day in Microsoft Defender and additional high-risk issues in Hyper-V, DHCP Client, Secure Boot, and UEFI components.
Jul 1, 2026
Microsoft’s latest security updates include a broad set of fixes across Windows, Office, Azure, Exchange, SharePoint, Remote Desktop, and other enterprise products, with several critical issues rated as highly likely to be exploited. Among the most serious is **`CVE-2026-47291`**, a critical **HTTP.sys** flaw with a **CVSS 9.8** score that can reportedly allow **unauthenticated remote code execution** in the Windows kernel-mode HTTP protocol stack, potentially giving attackers **SYSTEM-level** access. Microsoft also flagged multiple other high-risk issues in core Windows components and network-facing services, including vulnerabilities in **DHCP**, the **NT OS Kernel**, **NTLM**, **Remote Desktop Client**, and **SharePoint**. Separate Microsoft disclosures also detail new **Microsoft Edge (Chromium-based)** flaws affecting versions earlier than **`150.0.4078.48`**. These include **`CVE-2026-58281`**, a **deserialization of untrusted data** bug that can lead to remote code execution, and **`CVE-2026-58596`**, an **untrusted pointer dereference** issue that can enable elevation of privilege. Both vulnerabilities require user interaction but carry high impact if exploited, reinforcing concerns that browser and internet-exposed Windows components remain priority targets as vendors accelerate patch releases in response to faster vulnerability discovery and exploitation timelines.
Jul 14, 2026