The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four critical vulnerabilities affecting Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft Internet Key Exchange (IKE) Service Extensions to its Known Exploited Vulnerabilities (KEV) catalog after confirming that the flaws are being actively exploited. According to CISA, organizations using affected products should prioritize security updates and apply vendor provided patches to reduce exposure from ongoing exploitation attempts.
The vulnerabilities added to the KEV catalog include CVE 2026 65400 affecting Apple macOS, which carries a CVSS score of 9.8 and involves an improper authentication issue in Screen Sharing. The flaw could allow an attacker with network access to authenticate to Screen Sharing without valid credentials. Another vulnerability, CVE 2026 55040, impacts Microsoft SharePoint and has a CVSS score of 9.1. The weak authentication vulnerability could enable unauthorized attackers to bypass a security feature over a network. CISA also added CVE 2026 59310 affecting Broadcom VMware vCenter, a path traversal vulnerability with a CVSS score of 9.8 that could allow attackers with network access to execute arbitrary code on vulnerable systems. The fourth vulnerability, CVE 2026 33824, impacts Microsoft Internet Key Exchange Service Extensions and involves a double free vulnerability that could allow unauthorized attackers to execute code remotely over a network.
Although the affected vendors have released security patches for these vulnerabilities, multiple public reports indicate that attackers have already started exploiting the weaknesses. The Apple macOS vulnerability has reportedly been used to deliver a Monero cryptocurrency miner, while the Microsoft SharePoint flaw has been targeted by unknown attackers following the release of proof of concept code. The VMware vCenter vulnerability has been linked to activity by a suspected China nexus advanced persistent threat actor, who reportedly used the flaw to deploy a backdoor and reverse_ssh binaries to maintain access to compromised systems. In at least one reported case, the exploitation activity resulted in the deployment of a Babuk derived ransomware variant. The campaign associated with VMware vCenter exploitation has reportedly affected 361 unique victim IP addresses across 47 countries, with Germany, the United States, Turkey, Iran, and France among the most impacted regions.
Security researchers have also observed exploitation of CVE 2026 33824 affecting Microsoft IKE Service Extensions. According to Palo Alto Networks Unit 42, the vulnerability has been exploited by another Chinese speaking threat actor. Researchers said the group conducted operations involving known vulnerabilities while also launching an AI enabled autonomous hacking campaign using DeepSeek technology. The activity highlights the continued use of publicly known vulnerabilities by threat actors to target exposed systems and gain unauthorized access to enterprise environments. CISA has instructed Federal Civilian Executive Branch agencies to update affected systems to the latest available versions by August 21, 2026, in accordance with BOD 26 04 patching requirements. The agency continues to maintain the KEV catalog as a resource for organizations to identify vulnerabilities that require immediate attention due to confirmed exploitation activity. Security teams are advised to review affected systems, apply available patches, and follow recommended mitigation measures to strengthen protection against active cyber threats.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
