CISA adds four exploited critical flaws affecting macOS and enterprise systems

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four critical vulnerabilities affecting Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter and Microsoft Internet Key Exchange (IKE) Service Extensions to its Known Exploited Vulnerabilities (KEV) catalog. All four issues are being exploited in the wild and have CVSS scores from 9.1 to 9.8.

The additions are CVE-2026-65400 in macOS, CVE-2026-55040 in SharePoint, CVE-2026-59310 in VMware vCenter and CVE-2026-33824 in Microsoft IKE Service Extensions. Vendors have issued patches, but public reporting indicates that attackers have already put the vulnerabilities to use.

Four pathways to network compromise

CVE-2026-65400 is an improper authentication flaw in Apple macOS. An attacker on the network could authenticate to Screen Sharing without valid credentials. The vulnerability has been abused to deliver a Monero cryptocurrency miner.

Microsoft SharePoint vulnerability CVE-2026-55040 is a weak authentication issue that allows an unauthorized attacker to bypass a security feature over a network. Unknown actors exploited it after proof-of-concept code was released.

CVE-2026-59310 is a path traversal vulnerability in Broadcom VMware vCenter. A threat actor with network access to vCenter could execute arbitrary code. Public assessments link exploitation to a suspected China-nexus advanced persistent threat actor that deployed a backdoor and reverse_ssh binaries to retain access to compromised instances.

Ransomware and autonomous attack activity

In at least one vCenter intrusion, the campaign resulted in Babuk-derived ransomware. The activity compromised 361 unique victim IP addresses in 47 countries, with Germany recording 55 infections, followed by the United States with 41, Turkey with 38, Iran with 26 and France with 25.

The Microsoft IKE issue, CVE-2026-33824, is a double free vulnerability that can enable unauthorized remote code execution. Palo Alto Networks Unit 42 observed another Chinese-speaking actor exploiting it while running an AI-enabled autonomous hacking campaign using DeepSeek and conducting manual operations against known vulnerabilities. This combination of automated and hands-on activity aligns with the broader threat landscape described in exploitation chains and AI-agent incidents, where exploitation chains and AI-agent incidents require close operational attention.

Patch and verify exposed systems

Federal Civilian Executive Branch agencies must update vulnerable systems by August 21, 2026, and follow BOD 26-04 patching guidance. For other organizations, the immediate task is to identify affected macOS, SharePoint, vCenter and IKE deployments, install the relevant vendor updates, and review systems for unauthorized Screen Sharing access, unfamiliar backdoors, reverse_ssh binaries, cryptomining activity and ransomware indicators. Prompt remediation and post-patch investigation are the practical business priority because patches do not remove an attacker who has already gained access.