TL;DR
- what: CISA added four critical flaws in Apple macOS, Microsoft SharePoint, VMware vCenter, and Microsoft IKE Service Extensions to the Known Exploited Vulnerabilities catalog after confirming in the wild exploitation.
CISA added four vulnerabilities to the Known Exploited Vulnerabilities catalog on Tuesday. Every one of them carries a CVSS score of 9.1 or higher, and every one of them is being exploited right now. Federal Civilian Executive Branch agencies have until August 21, 2026 to remediate under BOD 26-04. A three day window is how CISA signals that the attacks are already at volume.
The affected products are Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft Internet Key Exchange Service Extensions. All four vendors shipped patches before the exploitation reports surfaced. That makes this a patch deployment problem rather than a zero day problem, which is worse in a specific way: the fixes were available and the attackers still found unpatched targets.
The four CVEs
- CVE-2026-65400 (CVSS 9.8), Apple macOS. Improper authentication lets a network adjacent attacker authenticate to Screen Sharing without valid credentials.
- CVE-2026-55040 (CVSS 9.1), Microsoft SharePoint. Weak authentication allows an unauthorized attacker to bypass a security feature over the network.
- CVE-2026-59310 (CVSS 9.8), Broadcom VMware vCenter. Path traversal gives any actor with network access to vCenter arbitrary code execution.
- CVE-2026-33824 (CVSS 9.8), Microsoft IKE Service Extensions. A double free allows unauthenticated remote code execution.
vCenter is the one that ends in ransomware
CVE-2026-59310 is the most consequential item on the list. A suspected China-nexus APT has been chaining the path traversal into code execution on vCenter, then dropping a backdoor alongside reverse_ssh binaries for durable outbound access. Reverse SSH is a deliberate choice: it dials out, so it survives inbound firewall rules and does not require the attacker to hold an exposed listener.
The campaign footprint is large for a single CVE. Public reporting counts 361 unique victim IP addresses across 47 countries, concentrated in Germany (55), the United States (41), Turkey (38), Iran (26), and France (25). In at least one confirmed case the intrusion ended in the deployment of a Babuk-derived ransomware family, which is the standard outcome once an actor holds the virtualization control plane.
That is the part IT managers should internalize. vCenter is not another application server. It manages the ESXi hosts, the datastores, and the snapshots, and most organizations run no endpoint agent on the hypervisors themselves. An attacker with vCenter can encrypt VMDK files directly, wipe snapshots, and bypass every guest level control you paid for. The gap between initial access and total loss of the virtual estate is measured in hours.
⚠️ Treat vCenter exposure as a breach assumption — If your vCenter was reachable from an untrusted network at any point since the patch shipped, patching alone does not close the incident. Hunt for reverse_ssh binaries, unexpected outbound SSH from management interfaces, new local accounts and SSO identities in vCenter, modified scheduled tasks, and any snapshot deletion events you cannot attribute to an operator.
macOS Screen Sharing with no credentials required
CVE-2026-65400 lets an attacker on the same network authenticate to Screen Sharing without valid credentials. The observed payload so far is a Monero cryptocurrency miner, which sits at the low end of the damage range. Do not read that as low risk. A miner proves the exploit is reliable, automated, and delivering interactive graphical access to macOS endpoints. The next operator to pick it up is not obligated to mine anything.
Screen Sharing exposure is common in creative teams, engineering labs, and any office where remote assistance was turned on once and never audited. Inventory which Macs have the service enabled, patch them, and consider whether the service needs to be listening at all.
SharePoint got hit right after the PoC dropped
CVE-2026-55040 is a weak authentication flaw that allows a security feature bypass over the network. Exploitation by unknown actors followed the release of public proof of concept code. The sequence is the one defenders see every quarter: vendor patches, researcher publishes, mass scanning begins within days, and the organizations still on the vulnerable build become the target set.
On-premises SharePoint deployments are the concern here. They tend to be internet facing, they tend to be old, and they tend to hold exactly the document repositories that make a ransomware negotiation expensive.
IKE, plus an AI assisted operator
CVE-2026-33824 is a double free in Microsoft Internet Key Exchange Service Extensions that yields unauthenticated remote code execution. Palo Alto Networks Unit 42 attributes exploitation to a Chinese-speaking threat actor who was simultaneously running an autonomous hacking campaign built on DeepSeek while conducting manual exploitation using known vulnerabilities, including this one.
That combination is the detail worth flagging. The same operator ran model driven automation for reconnaissance and chaining alongside hands on keyboard work against known CVEs. The practical effect is compression of the window between disclosure and exploitation at scale. IKE listens on UDP 500 and 4500 on VPN and edge infrastructure, so the exposed surface is precisely the equipment that sits outside your perimeter controls by design.
What to do before Friday
- Patch vCenter first. It has the highest blast radius, a confirmed APT operator, and a confirmed ransomware outcome.
- Pull vCenter, ESXi, and all management interfaces off any network segment reachable from user VLANs or the internet. Jump host access only.
- Patch on-premises SharePoint and confirm the build number rather than trusting the update service.
- Patch Windows systems running IKE Service Extensions, then verify UDP 500 and 4500 are not exposed beyond the peers that need them.
- Patch macOS endpoints and disable Screen Sharing where it is not an operational requirement.
- Hunt retroactively. All four flaws were exploited before they hit KEV, so a clean patch state today says nothing about last month.
If you cannot patch vCenter immediately — Restrict network access to the vCenter management interface to a small allowlist of jump hosts, enforce MFA on SSO, capture and store a copy of vCenter logs off box before an attacker can clear them, and verify that your backups of the virtual estate are immutable and restorable without vCenter itself being available.
The August 21 deadline is binding only on federal civilian agencies. The exploitation is not selective about who it reaches. Use the same date.
Originally published on RedEye Threat Intelligence.
