IRONSMITHINTEL
CRITICALCVSS9.8
|CVE-2026-33824|Auth: none|Reboot: required|Manual only

KB5082198: Windows Server 2016 Security Update (April 2026)

An attacker can take over any Windows Server with IPsec / IKEv2 enabled by sending a single crafted UDP packet, with no credentials.

Published Apr 14, 2026 · Updated May 21, 2026
Why patchRisk explained in plain English
Worst-case scenarioIf unpatched

An attacker who can reach UDP 500 or UDP 4500 on a vulnerable server — and these ports are exposed on the internet for any server acting as a VPN endpoint — can send a crafted IKEv2 packet, trigger the double-free, and execute code in the IKE service. The IKE service runs as SYSTEM, so the attacker lands with the highest privileges on the host, with no authentication and no user interaction.

How the attack works

The Windows Internet Key Exchange (IKE) Service Extensions are the component that negotiates IPsec security associations using IKEv2 — the protocol that establishes the keys behind site-to-site VPNs, "Always-On" VPN, and DirectAccess. A double-free bug in how the service handles memory during IKEv2 packet processing lets an attacker free the same memory twice, corrupt the heap, and gain code execution. The service listens on UDP 500 and 4500 on every Windows host that has IPsec configured.

Am I affected?Quick check

Probably yes if any of these apply:

●Any server acting as an IKEv2 / IPsec endpoint (VPN, "Always-On" VPN, DirectAccess)
●Any server with IPsec policies that respond to IKEv2 handshakes

Affected OS versions

Windows Server 2016
Real-world incidentsWhat we've seen

A retailer's site-to-site VPN endpoint sits on the internet on UDP 500/4500 — the standard configuration. An attacker scans for IKEv2 responders, finds the endpoint, and sends a single crafted packet. The VPN service crashes, the attacker tunes the exploit, and on the next attempt has SYSTEM-level code running on the firewall-segment server. Within minutes they pivot through the trusted VPN tunnel into the corporate network the VPN was supposed to protect.

How to patch

Manual download

For air-gapped servers or out-of-band deployment. Microsoft Update Catalog returns every OS-version variant of this update.

↗ Microsoft Update CatalogKB5082198

Manual remediation steps

If you cannot patch immediately

Block inbound UDP 500 and UDP 4500 at the perimeter firewall for any server that is not an intentional VPN endpoint. For intentional endpoints, restrict source addresses to known peers until the patch is applied.

Prerequisites

    1
    Local administrator on the target server
    1
    Maintenance window with reboot capacity
    1
    Current backup or snapshot you can roll back to
    1
    Network path to Windows Update / WSUS / Microsoft Update Catalog

Estimated time

20–40 minutes per server (download + install + reboot)

Reboot required

Yes — install the cumulative update and reboot the server before the fix is active.

Steps

1. Confirm the server is missing the patch

# If this returns the KB, you are already patched. If it returns nothing, continue.
Get-HotFix -Id KB5082198 -ErrorAction SilentlyContinue

2. Install the update — pick one channel

Windows Update / WSUS (preferred):

# Trigger an immediate scan and install
UsoClient ScanInstallWait
# (or use your standard WSUS / SCCM / Intune deployment for KB5082198)

Manual download (offline or air-gapped servers):

1
Open Microsoft Update Catalog: https://catalog.update.microsoft.com/Search.aspx?q=KB5082198
2
Download the MSU for Windows Server 2016 that matches your architecture (x64).
3
Copy the .msu file to the server and run as Administrator.

3. Reboot

Restart-Computer -Force

Verification

After the reboot:

# The KB must appear with an InstalledOn date
Get-HotFix -Id KB5082198

# Confirm OS build advanced
[System.Environment]::OSVersion.Version

If Get-HotFix returns nothing for KB5082198, the install did not take — re-run the update from a different channel.

Rollback

# Remove the update (last resort — only if the update breaks a workload)
wusa.exe /uninstall /kb:5082198 /quiet /norestart
# Reboot after uninstall

Cumulative updates can be removed but the server then loses every fix that update delivered, including this one. Prefer rolling forward to a newer cumulative.

Notes

    1
    This entry covers Windows Server 2016 specifically (KB5082198). Other Windows Server versions have their own KB for CVE-2026-33824.
    1
    Reference advisories: MSRC https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824 and NVD https://nvd.nist.gov/vuln/detail/CVE-2026-33824.
PowerShell automationComing soon

No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.

References

↗ CVE-2026-33824↗ MSRC Advisory↗ NVD↗ KBKB5082198