Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
CISA added four critical actively exploited flaws to KEV: macOS Screen Sharing, SharePoint, VMware vCenter, and Microsoft IKE, with APT and ransomware use.
CISA added CVE-2026-65400 (macOS Screen Sharing, CVSS 9.8), CVE-2026-55040 (SharePoint, CVSS 9.1), CVE-2026-59310 (VMware vCenter, CVSS 9.8) and CVE-2026-33824 (Microsoft IKE Service Extensions, CVSS 9.8) to the KEV catalog. The macOS flaw was abused to deliver a Monero miner, while the vCenter bug was exploited by a suspected China-nexus APT to install reverse_ssh backdoors and Babuk-derived ransomware across 361 victim IPs in 47 countries. Unit 42 linked CVE-2026-33824 to a Chinese-speaking actor running an AI-enabled campaign using DeepSeek. FCEB agencies must patch by August 21, 2026 under BOD 26-04.
- CVE-2026-65400 lets network attackers authenticate to macOS Screen Sharing without credentials
- Suspected China-nexus APT exploited vCenter CVE-2026-59310 to deploy reverse_ssh backdoors
- 361 victim IPs in 47 countries hit, including Babuk-derived ransomware deployments
- SharePoint flaw exploited after PoC release; IKE flaw used by Chinese-speaking actor with DeepSeek
- FCEB agencies must patch by August 21, 2026 under BOD 26-04
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1219 Remote Access SoftwareT1486 Data Encrypted for Impact
- Threat actors
- China-nexus APTChinese-speaking threat actor
- Countries
- GermanyUnited StatesTurkeyIranFrance
- AI models
- DeepSeek
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-33824 | Unauthenticated Double-Free RCE in Microsoft Windows IKE Extension | 9.8 | 77% | KEV | KEV |
| CVE-2026-55040 | Authentication Bypass in Microsoft SharePoint Server | 9.1 | 70% | KEVPoC ×2 | KEV |
| CVE-2026-59310 | Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog | 9.8 | 3% | KEVRansomwarePoC ×2 | KEV |
| CVE-2026-65400 | Authentication Bypass in Apple macOS Screen Sharing | 9.8 | 2% | KEV | KEV |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Aug 19, 2026 Vulnerability / Ransomware The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four critical vulnerabilities to its Known Exploited Vulnerabilities ( KEV ) catalog, stating they are being exploited in the wild.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.