Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. The flaws affect Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft Internet Key Exchange (IKE) Service Extensions.

The vulnerabilities include CVE-2026-65400 (CVSS 9.8), an improper authentication issue in macOS Screen Sharing that has been abused to deliver a Monero cryptocurrency miner; CVE-2026-55040 (CVSS 9.1), a weak authentication flaw in SharePoint exploited by unknown actors following PoC release; CVE-2026-59310 (CVSS 9.8), a path traversal in VMware vCenter exploited by a suspected China-nexus APT to deploy a backdoor and reverse_ssh binaries, leading to Babuk-derived ransomware in some cases; and CVE-2026-33824 (CVSS 9.8), a double free in Microsoft IKE exploited by a Chinese-speaking threat actor who also launched an AI-enabled autonomous hacking campaign using DeepSeek.

The vCenter campaign compromised 361 unique victim IPs across 47 countries, with most infections in Germany (55), the U.S. (41), Turkey (38), Iran (26), and France (25). Federal Civilian Executive Branch (FCEB) agencies must patch by August 21, 2026, per BOD 26-04 guidelines.