CISA gave agencies three days to patch this Windows flaw - here's whether it touches your PC

Microsoft fixed this one in April. On Wednesday, CISA added it to the list of vulnerabilities being used in real attacks and gave federal agencies three days to patch instead of the usual two weeks. That deadline tells you how the agency rates it.

CVE-2026-33824 sits in the Windows IKE Extension, networking plumbing that handles the handshake for encrypted VPN connections. It scores 9.8 out of 10, and the reason is the combination of properties rather than any one of them: an attacker can run code on the machine by sending it specially crafted packets, needs no password, and needs nothing at all from you. No click, no download. The traffic arrives on UDP ports 500 and 4500. Every supported version of Windows 10, Windows 11 and Windows Server is affected.

Now the part that should lower your pulse. Those ports have to be reachable for any of it to work, and on an ordinary home setup they aren't - your router doesn't hand unsolicited inbound traffic to your PC unless somebody deliberately set it up to. The machines genuinely exposed are ones sitting directly on the internet, or reachable across a network where an attacker already has a foothold. Neither Microsoft nor CISA has said who is exploiting it or how.

The patch has been in Windows Update since April's Patch Tuesday, and every monthly update since carries it forward. So the question isn't whether you need it - it's whether your updates have actually been installing. Tendvane's security-posture check answers that in a few seconds, and the Windows Update repair wizard is there for the PCs where updates keep failing.