Microsoft published its Security Updates for April 2026 today, and the good news is that there are no Windows Server Routing and Remote Access (RRAS) vulnerabilities this month. However, they disclosed a critical remote code execution (RCE) vulnerability that impacts deployments using Internet Key Exchange version 2 (IKEv2).
IKE Service Extensions RCE
CVE-2026-33824 addresses a security vulnerability in the Windows Internet Key Exchange (IKE) Service Extensions. This vulnerability is a Remote Code Execution (RCE) vulnerability, with a CVSS 3.1 base score of 9.8 (Critical). Always On VPN implementations that use the device tunnel or IKEv2 for the user tunnel are affected.
Impact
This vulnerability presents a unique challenge to Always On VPN administrators as IKEv2 is required to support device tunnel connections. Some implementations also use IKEv2 for the user tunnel. In either case, the vulnerable VPN server, often domain-joined, is reachable from the Internet, greatly increasing the attack surface and exposure to this vulnerability.
Recommendations
For deployments that use IKEv2 (device or user tunnel), administrators should update their RRAS server as soon as possible to protect against potential attacks on this service.
Not Using IKEv2?
If you are not using the device tunnel or IKEv2 for the user tunnel, ensure the following IKEv2 ports are blocked at the edge firewall.
- Inbound UDP port 500 (IKE)
- Inbound UDP port 4500 (IKE NAT-T)
In addition, consider disabling IKEv2 on the RRAS server by opening an elevated command window and running the following command.
netsh.exe ras set wanports device = "WAN Miniport (IKEv2)" rasinonly = disabled ddinout = disabled ddoutonly = disabled maxports = 0
Optionally, you can use the Routing and Remote Access management console (rrasmgnt.msc) to perform this task.
- Right-click on Ports and choose Properties.
- Select WAN Miniport (IKEv2).
- Click Configure.
- Uncheck Remote access connections (inbound only).
- Uncheck Demand-dial routing connection (inbound and outbound).
- Enter 0 in the Maximum ports field.
- Click Ok.
Additional Information
Microsoft Security Updates for April 2026
CVE-2026-33824 – Windows Internet Key Exchange (IKE) Service Extension RCE
