Four Critical Vulnerabilities Exploited Against macOS, SharePoint, VMware vCenter, and Windows

CISA Updates KEV Catalog: Remediation Due by August 21

CISA has added four actively exploited critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The flaws affect Apple macOS, Microsoft SharePoint Server, VMware vCenter, and the Windows Internet Key Exchange service.

The vulnerabilities were added to the catalog on August 18, 2026. For U.S. federal civilian agencies subject to FCEB requirements, the remediation deadline is August 21, 2026.

All four vulnerabilities share characteristics that increase their operational risk: they are network-exploitable, require low complexity, do not require prior privileges, and need no user interaction. Three have a CVSS score of 9.8, while the SharePoint vulnerability scores 9.1.

The KEV catalog confirms active exploitation but does not identify known ransomware campaigns for any of the four entries; the relevant field is “Unknown.” However, details are available on separate activity that has reportedly already affected exposed systems.

macOS: Screen Sharing Authentication Bypass

CVE-2026-65400 affects Apple macOS and is classified as CWE-287, Improper Authentication. It has a CVSS score of 9.8, with a high impact on confidentiality, integrity, and availability.

An attacker on the network can authenticate to the Screen Sharing service without valid credentials. According to NVD data, the vulnerability affects:

apple macos < 14.8.9

The listed fixes are:

• macOS Sequoia 15.7.9;
• macOS Sonoma 14.8.9;
• macOS Tahoe 26.6.1.

The updates address the issue through improved handling of authentication state. The vulnerability has reportedly been exploited to deliver a Monero miner, turning compromised systems into resources for unauthorized cryptocurrency mining.

Administrators managing Macs with Screen Sharing enabled should immediately verify the installed version, apply the update, and check for unusual CPU consumption, unknown processes, and outbound connections. CISA does not identify the miner as an official indicator associated with the KEV entry; investigations should therefore also cover other suspicious artifacts.

SharePoint: Security Feature Bypass After PoC Disclosure

CVE-2026-55040 affects Microsoft SharePoint Server. It is an authentication weakness classified as CWE-1390, with a CVSS score of 9.1.

An unauthorized user can exploit the flaw over the network to bypass a security feature. The affected product is listed as:

microsoft sharepoint server < 16.0.19725.20434

According to the CVSS vector, the vulnerability does not directly affect availability, but it can have serious consequences for the confidentiality and integrity of data managed by the platform. SharePoint is often integrated with corporate documents, identities, workflows, and collaboration services, so a control bypass can become a stepping stone to broader access.

The vulnerability was reportedly exploited by unidentified actors after proof-of-concept (PoC) code was published. IT teams should verify that updates have brought the server above the specified build and review logs for anomalous requests, unexpected authentication events, and access to resources from unusual addresses.

Installing the patch alone does not prove that a system has not already been compromised. An exposed instance should also undergo forensic review, particularly if it shows modified accounts, web shells, new administrative activity, or unexpected data transfers.

VMware vCenter: Path Traversal in the Syslog Server

CVE-2026-59310 affects the VMware vCenter Syslog server. The vulnerability is classified as CWE-22, Path Traversal, and has a CVSS score of 9.8.

An attacker with network access to vCenter can manipulate paths used by the service and achieve arbitrary code execution. The issue affects the following products and versions:

• VMware vCenter Server < 8.0;
• VMware Telco Cloud Infrastructure 3.0;
• VMware Telco Cloud Platform <= 5.2;
• VMware Cloud Foundation;
• VMware vSphere Foundation.

No precise version constraint is provided for VMware Cloud Foundation or VMware vSphere Foundation. Organizations should therefore compare their deployments with the vendor’s remediation guidance rather than assuming that the absence of a build number in the catalog means there is no risk.

The exploitation has been attributed to a suspected China-linked APT group. Observed intrusions reportedly involved the installation of a backdoor and components named reverse_ssh, used to maintain persistent access through reverse SSH connections. In at least one case, the activity reportedly preceded the deployment of ransomware derived from Babuk.

Administrators should search for unauthorized processes and files, recently added SSH keys, persistent connections to external infrastructure, and changes to logging services. A compromised vCenter should be treated as a potential control point for the entire virtualized environment, not as an isolated server.

Microsoft IKE: Potential Code Execution on Windows Systems

The fourth vulnerability is CVE-2026-33824, a double-free condition classified as CWE-415 in the Microsoft Internet Key Exchange (IKE) Service Extensions. It has a CVSS score of 9.8.

A remote, unauthenticated attacker can achieve code execution over the network. The affected versions are:

• Windows 10 1607 < 10.0.14393.9060;
• Windows 10 1809 < 10.0.17763.8644;
• Windows 10 21H2 < 10.0.19044.7184;
• Windows 10 22H2 < 10.0.19045.7184;
• Windows 11 23H2 < 10.0.22631.6936;
• Windows 11 24H2 < 10.0.26100.8246;
• Windows 11 25H2 < 10.0.26200.8246;
• Windows 11 26H1 < 10.0.28000.1836;
• Windows Server 2016 < 10.0.14393.9060;
• Windows Server 2019 < 10.0.17763.8644;
• Windows Server 2022 < 10.0.20348.5020;
• Windows Server 2022 23H2 < 10.0.25398.2274.

The activity was reportedly conducted by a Chinese-speaking group. The same operation allegedly combined AI-assisted autonomous hacking tools, including DeepSeek, with manual techniques targeting known vulnerabilities.

Defenders should urgently assess exposure of VPN services and IKE interfaces. After updating, they should review authentication events, anomalous negotiations, processes created by network services, and connections to addresses not included in normal operational allowlists.

Activity Overview and Recent KEV Entries

The activity associated with the four flaws reportedly affected 361 unique victim IP addresses across 47 countries. The largest concentrations were reportedly in Germany, with 55 addresses; the United States, with 41; Türkiye, with 38; Iran, with 26; and France, with 25.

These figures do not necessarily represent the same number of organizations: a single entity may use multiple IP addresses, while the same infrastructure may host systems with different roles.

The simultaneous addition of Apple, Microsoft, and VMware products also comes amid a recent sequence of KEV entries involving the same vendors. Over the past 90 days, CVE-2026-50522, CVE-2026-58644, CVE-2026-45659, CVE-2026-11645, and CVE-2026-8398 have been added. Among them, CVE-2026-45659 is associated with ransomware.

Microsoft also has CVE-2026-72898, CVE-2026-68820, and CVE-2026-20349 listed in the catalog. This context makes it unwise to treat the four new vulnerabilities as isolated incidents.

What Organizations Should Do

The priority is to apply vendor fixes and verify that installed versions are actually above the vulnerable thresholds. CISA requires FCEB agencies to comply with BOD 26-04, assessing the risk and Internet exposure of each asset.

Recommended actions include:

1. identify exposed macOS, SharePoint, vCenter, and Windows systems;
2. apply patches or mitigations according to the respective vendors’ guidance;
3. perform forensic triage before or alongside remediation;
4. review accounts, processes, SSH keys, logs, and recent connections;
5. search for miners, backdoors, reverse_ssh binaries, and ransomware components;
6. discontinue use of the product if no practical mitigations are available.

The August 21, 2026 deadline applies to U.S. federal civilian agencies. Private organizations should also treat these four CVEs as priorities because their inclusion in the KEV catalog documents real-world exploitation, not merely a theoretical possibility.