CISA Flags Four Actively Exploited Flaws in macOS, SharePoint, vCenter, and Microsoft IKE

Four critical vulnerabilities that attackers are already using to take over servers and Macs landed on the U.S. government's mandatory-patch list this week, and two of them are internet-facing bugs that have been turned into backdoors and ransomware.

The Cybersecurity and Infrastructure Security Agency (CISA) added four flaws to its Known Exploited Vulnerabilities (KEV) catalog on August 18, covering Apple macOS, Microsoft SharePoint, Broadcom's VMware vCenter, and Microsoft's Internet Key Exchange (IKE) service. All four are confirmed exploited in the wild, and three carry a CVSS score of 9.8. Federal civilian agencies have until August 21, 2026, to patch them under Binding Operational Directive 26-04. "These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise," CISA wrote, in the standard language that accompanies each KEV update. The deadline is binding only on federal agencies, but the exploitation is indifferent to who owns the box.

Here is what security teams actually need from this batch: not four separate fire drills, but a priority order. Two of the four (VMware vCenter and Microsoft IKE) are unauthenticated remote code execution bugs with documented post-exploitation activity behind them. The other two (macOS and SharePoint) are authentication bypasses. All four need patching, but they do not carry the same blast radius.

The Four Flaws at a Glance

The four additions to the CISA KEV catalog, August 18, 2026. CVSS scores as listed by The Hacker News and NVD; SecurityWeek listed CVE-2026-65400 at 7.5. Sources: CISA, The Hacker News, SecurityWeek.

The macOS issue, CVE-2026-65400, is an improper authentication flaw in Screen Sharing that lets an attacker on the network log in without valid credentials. The Hacker News reported it at CVSS 9.8, though SecurityWeek listed it at 7.5, one of the few discrepancies in an otherwise consistent set of numbers. CVE-2026-55040 is a weak-authentication flaw in Microsoft SharePoint that lets an unauthorized attacker bypass a security feature over the network. CVE-2026-59310 is a path traversal bug in Broadcom's VMware vCenter that yields code execution for anyone with network access to the appliance. CVE-2026-33824 is a double free in Microsoft's IKE Service Extensions that allows unauthenticated code execution through crafted packets.

Which Two Should Move First

Prioritize the vCenter and IKE bugs, because those are the ones with confirmed payloads behind them. The VMware vCenter flaw, patched on July 29, came under attack starting August 3, according to SecurityWeek. The Hacker News reports the activity is assessed to be the work of a suspected China-nexus advanced persistent threat (APT) group that deployed a backdoor and reverse_ssh binaries for persistent access, and in at least one case dropped a Babuk-derived ransomware strain. That campaign has reportedly touched 361 unique victim IP addresses across 47 countries, concentrated in Germany (55), the United States (41), Turkey (38), Iran (26), and France (25).

The IKE double free, CVE-2026-33824, was patched back in April but has been folded into a stranger campaign. Palo Alto Networks' Unit 42 flagged it as one of the known vulnerabilities a Chinese-speaking threat actor used alongside an AI-enabled autonomous hacking operation built on DeepSeek. A hands-on-keyboard operator and an automated agent hitting the same targets is the detail worth sitting with: it means the gap between a public patch and opportunistic exploitation keeps shrinking, and old fixes stay dangerous long after they ship.

The two authentication bypasses are serious but sit a step behind. The SharePoint bug was fixed on Microsoft's July 2026 Patch Tuesday and drew exploitation earlier this month after a proof-of-concept was published, the same pattern behind an earlier SharePoint zero-day added to KEV. The macOS flaw followed the same proof-of-concept-to-exploitation curve.

The macOS Screen Sharing Thread Continues

CVE-2026-65400 is not new to CyberSignal readers. Apple patched it on August 6, and in-the-wild exploitation was observed less than a week later, with attackers using it to gain root access and install a Monero cryptocurrency miner. We covered that cryptominer campaign and the broader active-exploitation warning when they broke. The KEV listing is the federal government formalizing what researchers had already documented: a network-reachable Mac running an unpatched Screen Sharing service can be logged into by someone who never had the password.

What's Confirmed, and What Isn't

The CVE identifiers, the vendors, the weakness classes, and the August 21 deadline are all confirmed across CISA, The Hacker News, and SecurityWeek. What these disclosures do not pin down is worth stating just as plainly: no specific affected build numbers are named in the KEV entries, and no victim organizations have been publicly identified. The 361-IP figure describes observed infections, not confirmed breaches of named companies. Treat the version guidance as "apply the vendor's latest fix," not a single build number to match.

What Defenders Should Do Now

• Patch all four immediately where the affected products exist in your environment. The vendors shipped fixes months ago for IKE, SharePoint, and vCenter, and on August 6 for macOS, so this is a deployment problem, not a waiting-for-a-patch problem.
• Find internet-facing vCenter and SharePoint first. An exposed vCenter appliance or SharePoint server is the highest-value target in this set. Confirm whether either is reachable from outside your network, and if it is, patch it before anything else and check it for the reverse_ssh and backdoor indicators tied to the vCenter campaign.
• Restrict macOS Screen Sharing. Disable Screen Sharing where it is not needed, and block port 5900 at the network edge so a Mac cannot be reached for the credential-free login.
• Order the work by the KEV deadline, then by exposure. August 21 is the federal line, and it is a reasonable internal target too. Within it, sequence by what is internet-facing and what has a known payload: vCenter and IKE before the two authentication bypasses.
• Hunt, don't just patch. For vCenter, a patch closes the door but does not evict an attacker who already walked through it. Review logs across the exploitation window (early-to-mid August for vCenter, this month for SharePoint) and treat any exposed, previously unpatched appliance as potentially compromised.

My read: The through-line in this batch is speed, and I offer that as an assessment rather than a reported fact. Three of these four were patched weeks or months before CISA listed them, yet they are on the exploited list anyway, and one was pulled into an AI-assisted campaign. The takeaway for defenders is not "patch faster" as a slogan but as a number: your mean time to patch internet-facing remote code execution bugs is now competing against automated exploitation, and vCenter is the specific box to measure it on this week.

Primary Documents

• CISA: CISA Adds Four Known Exploited Vulnerabilities to Catalog (August 18, 2026)
• CISA Known Exploited Vulnerabilities Catalog
• The Hacker News: Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
• SecurityWeek: CISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities
• Palo Alto Networks Unit 42: AI-Enabled Autonomous Attack Campaign