CISA added four critical Apple, Microsoft and VMware flaws to its KEV catalog after confirming active exploitation in the wild.
Four serious security flaws affecting Apple, Microsoft and VMware products are already being exploited by attackers, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add them to its Known Exploited Vulnerabilities catalog.
The affected products include macOS, Microsoft SharePoint, VMware vCenter Server and Microsoft’s Internet Key Exchange (IKE) service.
All four vendors have released security updates for the affected products. The problem is that attackers aren’t waiting around for organizations to install them.
The vulnerabilities are tracked as CVE-2026-65400, CVE-2026-55040, CVE-2026-59310 and CVE-2026-33824.
The Apple vulnerability, CVE-2026-65400, affects macOS Screen Sharing and carries a CVSS score of 9.8.
The flaw can allow an attacker on the same network to authenticate to Screen Sharing without valid credentials.
Attackers have already been seen exploiting the vulnerability and using access to install a Monero cryptocurrency miner on affected Macs.
Apple has since released updates addressing the issue. The incident is another reminder of why services such as remote access and screen sharing shouldn’t be left exposed unnecessarily.
Microsoft SharePoint is affected by CVE-2026-55040, which has a CVSS score of 9.1.
The vulnerability involves weak authentication and can allow an unauthorized attacker to bypass a security feature over a network.
Exploitation reportedly picked up after proof-of-concept code became available publicly. The attackers behind the activity have not been identified.
Microsoft has released a fix, but organizations running affected SharePoint systems still need to make sure the update has actually been installed.
CVE-2026-59310 affects VMware vCenter Server and carries a CVSS score of 9.8.
The vulnerability is a path traversal flaw that can allow an attacker with network access to execute arbitrary code on a vulnerable server.
Researchers have linked exploitation to a suspected China-nexus threat actor. During attacks, investigators observed the deployment of a backdoor and reverse SSH tools.
In at least one incident, the intrusion eventually led to the deployment of a ransomware strain derived from Babuk.
The China connection remains a researcher assessment rather than a confirmed identification of the attackers.
The fourth vulnerability, CVE-2026-33824, affects Microsoft’s Internet Key Exchange Service Extensions.
It’s another 9.8-rated vulnerability and is described as a double-free flaw that can allow an unauthenticated attacker to execute code over a network.
Palo Alto Networks’ Unit 42 has observed exploitation of the vulnerability against Windows IKE VPN endpoints. Researchers also described the activity as involving AI-assisted techniques.
That doesn’t mean every attack using the vulnerability is AI-driven. The AI component is part of Unit 42’s findings from the specific campaign it investigated.
The exploitation campaigns have reached systems in dozens of countries.
According to The Hacker News, researchers identified 361 unique victim IP addresses across 47 countries.
Germany accounted for 55 of those addresses, followed by the United States with 41, Turkey with 38, Iran with 26 and France with 25.
Those numbers shouldn’t be read as 361 confirmed organizations. They’re unique IP addresses, and a single organization can have multiple addresses.
CISA added all four vulnerabilities to its KEV catalog on August 18, 2026.
Federal Civilian Executive Branch agencies have until August 21 to address the vulnerabilities under Binding Operational Directive 26-04. The deadline applies to those federal agencies and is not a universal deadline for private companies.
For everyone else, there may not be a formal deadline, but the message is pretty clear: these aren’t theoretical vulnerabilities anymore.
Attackers are already using them.
If an organization is running an affected version of macOS, SharePoint, VMware vCenter Server or Microsoft’s IKE service, installing the available security updates should be treated as a priority.
Sources: CISA and Hacker News
Related articles :
- CISA Flags Cisco, Chrome, Arista Flaws Under Attack
- CISA Flags Cisco SD-WAN CVE-2026-20182 Exploits
- CISA Warns of Exploited Joomla JCE RCE Flaw
Reports are sourced from official documents, law-enforcement updates, and credible investigations.
Discover additional reports, market trends, crime analysis and Harm Reduction articles on DarkDotWeb to stay informed about the latest dark web operations.
