Loading story…
bjCSIRT issued an alert for a remote code execution vulnerability affecting extensions of the Windows Internet Key Exchange (IKE) service. Successful exploitation could allow an unauthenticated attacker to execute code on exposed Windows systems, making rapid identification of affected IKE-enabled hosts and application of Microsoft security updates a priority.
Microsoft has also reported that its multi-model agentic security system identified 16 previously unknown vulnerabilities, illustrating expanded AI-assisted vulnerability discovery across software ecosystems. Security teams should review Microsoft and national-CSIRT advisories for the affected IKE extension, prioritize remediation based on internet exposure, and restrict IKE services to required, trusted network paths until patches are deployed.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
bjCSIRT published an alert concerning a remote-code-execution vulnerability affecting Windows Internet Key Exchange (IKE) service extensions.
Microsoft reported that its new multi-model agentic security system found 16 previously unidentified vulnerabilities while evaluating its performance against an industry benchmark.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
csirt.bj
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has disclosed **CVE-2026-33824**, a remote code execution vulnerability in Windows **Internet Key Exchange (IKE) Service Extensions**, prompting calls for rapid patching of systems that rely on IPsec for VPNs, secure tunnels, and trust relationships. The flaw affects a core Windows networking component commonly exposed on servers, gateways, and other perimeter-facing assets, raising concern that externally reachable hosts could be targeted first even though public technical details remain limited. Reporting on the advisory says defenders should not treat the sparse disclosure as low risk, because Microsoft’s confidence assessment indicates the vendor considers the issue credible and actionable. Security teams are being urged to inventory IKE- and IPsec-dependent systems, prioritize internet-facing devices for remediation, apply Microsoft updates quickly, and verify that tunnels and authentication workflows continue to function after patching, amid broader concern that attackers can use advisory details to begin probing and reverse engineering vulnerable services.
Jun 29, 2026
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog, raising the total from 1666 to 1670 entries and flagging active exploitation affecting **Microsoft Internet Key Exchange (IKE) Service Extensions**, **Microsoft SharePoint**, **Broadcom VMware vCenter**, and **Apple macOS Screen Sharing**. The newly listed issues are `CVE-2026-33824`, `CVE-2026-55040`, `CVE-2026-59310`, and `CVE-2026-65400`, covering weaknesses that can enable remote code execution, path traversal, weak authentication, or improper authentication. Under **BOD 22-01**, CISA directed U.S. federal agencies to remediate all four flaws by **2026-08-21** and urged other organizations to review exposure and apply available fixes. Reporting on the update said the SharePoint issue is tied to a JWT forgery attack chain, while the macOS Screen Sharing flaw was confirmed as actively exploited by the Dutch National Cyber Security Centre; Apple has already released patches, and CISA's KEV data indicates ransomware use is currently unknown for all four CVEs.
Aug 23, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (**CISA**) added **CVE-2024-43468** to its Known Exploited Vulnerabilities (KEV) catalog after determining the flaw is being **actively exploited in the wild**. The vulnerability is a **critical (CVSS 9.8) SQL injection** in *Microsoft Configuration Manager* (ConfigMgr/SCCM) that can allow an **unauthenticated remote attacker** to achieve **remote code execution** by sending specially crafted requests, enabling command execution on the ConfigMgr server and/or its underlying site database with **high/`SYSTEM`-level impact**. CISA set a remediation deadline of **March 5** for U.S. Federal Civilian Executive Branch agencies under its Binding Operational Directive requirements; public reporting noted Microsoft’s advisory had previously assessed exploitation as “less likely,” and Microsoft had not (as of reporting) publicly detailed the threat actors or scope of exploitation. The issue was originally patched by Microsoft in **October 2024** after being reported by **Synacktiv**, and proof-of-concept exploit code was later published (including by Synacktiv), lowering the barrier to weaponization. Separate CISA KEV updates the same week also drove patching urgency across other widely deployed products (including **SolarWinds Web Help Desk** and multiple **Apple** platforms for a reportedly “extremely sophisticated” targeted attack), reinforcing that organizations should treat KEV additions as a high-confidence signal to accelerate patching and exposure reduction—particularly for internet-reachable management tooling like ConfigMgr that can provide broad administrative control if compromised.
Jun 29, 2026