U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog
CISA adds actively exploited flaws in Microsoft IKE, SharePoint, VMware vCenter, and macOS Screen Sharing to KEV catalog, due August 21.
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-33824 (Windows IKE remote code execution, CVSS 9.8), CVE-2026-55040 (SharePoint JWT authentication bypass, CVSS 9.1), CVE-2026-59310 (VMware vCenter Syslog path traversal, CVSS 9.8), and CVE-2026-65400 (macOS Screen Sharing improper authentication). The SharePoint flaw combines four weaknesses including alg:none JWT forging to impersonate any user, with Defused researchers observing attackers using Rapid7's PoC against honeypots. The Dutch NCSC confirmed active exploitation of the macOS Screen Sharing flaw on August 15, 2026. Federal agencies must patch by August 21, 2026.
- SharePoint JWT bypass chain lets unauthenticated attackers forge administrator tokens
- macOS Screen Sharing flaw actively exploited per Dutch NCSC, patched in Tahoe 26.6.1
- VMware vCenter Syslog path traversal allows arbitrary code execution with network access
- Windows IKE double-free RCE exploitable via UDP ports 500 and 4500
- Federal agencies must remediate all four flaws by August 21, 2026
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-33824 | Unauthenticated Double-Free RCE in Microsoft Windows IKE Extension | 9.8 | 77% | KEV | KEV |
| CVE-2026-55040 | Authentication Bypass in Microsoft SharePoint Server | 9.1 | 70% | KEVPoC ×2 | KEV |
| CVE-2026-59310 | Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog | 9.8 | 3% | KEVRansomwarePoC ×2 | KEV |
| CVE-2026-65400 | Authentication Bypass in Apple macOS Screen Sharing | 9.8 | 2% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bynar.io | diting researcher Alfredo Pesoli (@__rev) at Bynario Atlas (bynar.io) for the discovery. “An attacker on the network may be able |
From the original article
3 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.