What is the CVSS score of EUVD-2026-22641?

EUVD-2026-22641 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft are affected by EUVD-2026-22641?

Windows IKE Extension contains a critical remote code execution vulnerability affecting Windows 10, 11, and Server editions (2016-2025) that allows unauthenticated network attackers to execute…. A patch is available.

How to fix or mitigate EUVD-2026-22641?

Within 24 hours: Identify all Windows 10 (1607-22H2), Windows 11 (22H3-26H1), and Windows Server (2016-2025) systems in your environment. Within 7 days: Apply the Microsoft-released patch for CVE-2026-33824 to all affected systems, prioritizing internet-facing and critical infrastructure assets. Within 30 days: Verify patch deployment across all in-scope systems and confirm no systems remain unpatched; conduct network segmentation review to restrict IKE (UDP 500/4500) access where operationally feasible.

Microsoft EUVD-2026-22641

| CVE-2026-33824 CRITICAL

Double Free (CWE-415)

2026-04-14 microsoft

Authentication Bypass Microsoft

9.8

CVSS 3.1 · NVD

Temporal: 8.5

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

8.5 HIGH

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 17, 2026 - 15:32 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:37 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22641

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:58 nvd

CRITICAL 9.8

DescriptionCVE.org

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthenticated network attackers to execute arbitrary code on Windows 10 (1607-22H2), Windows 11 (22H3-26H1), and Windows Server (2016-2025). CVSS 9.8 critical severity with network vector requiring no authentication or user interaction. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Scan for UDP 500/4500 exposure

Delivery

Send malformed IKE packets

Exploit

Trigger double free in parser

Install

Corrupt heap metadata

Achieve code execution as SYSTEM

Execute

Install persistence mechanism

Impact

Impact (data theft, lateral movement)

Recon

Scan for UDP 500/4500 exposure

Delivery

Send malformed IKE packets

Exploit

Trigger double free in parser

Install

Corrupt heap metadata

Achieve code execution as SYSTEM

Execute

Install persistence mechanism

Impact

Impact (data theft, lateral movement)

Vulnerability AssessmentAI

Exploitation	No special conditions required according to CVSS vector (PR:N/UI:N) - remote unauthenticated exploitation against default IKE service configurations on Windows systems. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 9.8 reflects maximum theoretical impact: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), with complete compromise of confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An external attacker sends specially crafted IKE protocol packets to UDP port 500 or 4500 on an exposed Windows system running vulnerable VPN or IPsec services. The malformed packets trigger the double free condition in the Windows IKE Extension's packet parsing code, corrupting heap memory structures. …
Remediation	Apply Microsoft security updates released in the monthly patch cycle to upgrade Windows to the fixed versions: Windows 10 1607/Server 2016 to build 10.0.14393.9060 or later, Windows 10 1809/Server 2019 to 10.0.17763.8644 or later, Windows 10 21H2 to 10.0.19044.7184 or later, Windows 10 22H2 to 10.0.19045.7184 or later, Windows 11 22H3/23H2 to 10.0.22631.6936 or later, Windows 11 24H2/Server 2025 to 10.0.26100.32690 or later, Windows 11 25H2 to 10.0.26200.8246 or later, Windows 11 26H1 to 10.0.28000.1836 or later, Windows Server 2022 23H2 to 10.0.25398.2274 or later. … Detailed patch versions, workarounds, and compensating controls in full report.