Summary
- CISA added four Microsoft, VMware, and Apple vulnerabilities to its Known Exploited Vulnerabilities catalogue on 18 August after evidence of active exploitation.
- The flaws affect Windows IKE, on-premises SharePoint Server, VMware vCenter, and macOS Screen Sharing, with substantially different routes to exposure and potential consequences.
- Exploitation evidence raises their priority, but reachability, privilege, asset role, and operational dependency determine where each belongs in an organisation’s remediation queue.
Four vulnerabilities affecting Windows networking, on-premises SharePoint, VMware vCenter, and macOS Screen Sharing have crossed an important threshold: there is now evidence that attackers are exploiting each of them in the wild.
On 18 August, the US Cybersecurity and Infrastructure Security Agency added CVE-2026-33824, CVE-2026-55040, CVE-2026-59310, and CVE-2026-65400 to its Known Exploited Vulnerabilities catalogue. Between them, the four flaws affect Microsoft Windows Internet Key Exchange services, Microsoft SharePoint Server, VMware vCenter, and Apple macOS Screen Sharing.
Although they arrived in the catalogue together, none was first disclosed this week. The Windows vulnerability dates to April, the SharePoint flaw to July, Broadcom published its vCenter advisory on 29 July, and Apple released fixes for the Screen Sharing issue on 6 August. What has changed is the exploitation evidence, turning four existing patching decisions into more immediate questions about exposure, privilege, and the role of the affected systems.
CISA’s mandatory KEV remediation deadlines apply to US federal civilian agencies rather than UK or European organisations. Even so, the catalogue provides a useful signal well beyond the US government because inclusion reflects evidence that a flaw has moved from theoretical or potential exploitation into observed malicious use.
CVE-2026-33824: Windows IKE remote code execution
Dating back furthest of the four, CVE-2026-33824 is also one of the most severe on paper. Microsoft describes it as a double-free vulnerability in the Windows Internet Key Exchange Server Extension that can allow an unauthorised attacker to execute code over a network.
When Microsoft disclosed the flaw on 14 April, it assigned a CVSS base score of 9.8 and said exploitation required neither authentication nor user interaction. At that point, however, the company said it had not observed exploitation before the security update was released.
Its appearance in KEV four months later changes the practical context. A vulnerability that may have gradually slipped down a remediation backlog now carries evidence that attackers are using it, and that makes any remaining unpatched exposure harder to treat as routine technical debt.
Simply identifying affected Windows versions is not enough to determine urgency. More useful questions concern whether the relevant IKE functionality is present, which systems expose it to potentially hostile network traffic, whether Microsoft’s April fixes reached those machines, and what operational role the affected hosts perform. A server involved in VPN or network connectivity can present a materially different risk from an ordinary endpoint running the same operating system.
CVE-2026-55040: SharePoint’s authentication weakness
Where the Windows flaw concerns remote code execution, CVE-2026-55040 moves the discussion into authentication. Microsoft describes the SharePoint vulnerability as weak authentication that can allow an unauthorised attacker to bypass a security feature over a network.
Disclosed on 14 July, the flaw appears in Microsoft’s July security updates for SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. That product scope is important because the immediate exposure concerns server deployments rather than every organisation using Microsoft’s cloud-hosted SharePoint services.
For organisations still running SharePoint Server, however, the potential consequence extends beyond the vulnerability itself. SharePoint farms often accumulate years of internal documents, commercial material, workflows, integrations, and access permissions, placing authentication controls directly in front of large stores of sensitive corporate information.
Assessing exposure therefore requires more than locating the affected software. Organisations need to establish which SharePoint Server farms remain in production, whether the July updates have been installed, how those deployments can be reached, and what data and permissions sit behind them. Two technically identical vulnerable servers may represent very different levels of risk depending on how they are deployed and what they contain.
CVE-2026-59310: vCenter brings infrastructure leverage
Of the four vulnerabilities, CVE-2026-59310 has the clearest implications for infrastructure management. Broadcom describes the flaw as a directory-traversal vulnerability in the vCenter Syslog server through which a malicious actor with network access to vCenter may be able to execute arbitrary code.
Broadcom rates the issue Critical with a maximum CVSS v3 score of 9.8. Its advisory, first published on 29 July and updated on 3 August, lists no workaround, leaving patched versions as the remediation route across affected deployments in VMware Cloud Foundation, vSphere Foundation, standalone vCenter, and relevant telco cloud products.
Severity alone does not explain why this vulnerability deserves particular attention. Because vCenter is used to administer virtual infrastructure, compromise of the management layer can carry a different potential blast radius from compromise of an isolated workload, especially where the platform sits close to production systems or highly privileged administrative identities.
Exactly how serious that exposure becomes depends on architecture rather than the CVE record alone. Network segmentation around vCenter, the identities and services permitted to reach it, the infrastructure under management, and the privileges available from the compromised system all shape the possible consequence.
Remediation also comes with an operational dimension. Central infrastructure-management systems are often subject to careful change controls precisely because large numbers of workloads depend on them, yet Broadcom’s advisory provides no workaround that would allow organisations to defer patching indefinitely. That leaves teams balancing the sensitivity of infrastructure change against a vulnerability now associated with active exploitation.
CVE-2026-65400: exposed Macs are already being compromised
Unlike the other three flaws, the macOS Screen Sharing vulnerability comes with unusually specific public evidence of what successful exploitation has looked like in practice. Apple disclosed CVE-2026-65400 on 6 August, saying an attacker on the network may be able to authenticate to Screen Sharing without valid credentials because of an authentication issue.
Fixes were released in macOS Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1. Shortly afterwards, the Netherlands’ National Cyber Security Centre reported active exploitation affecting multiple systems.
The conditions reported by the NCSC are especially important when judging enterprise exposure. In the incidents known to the agency, Screen Sharing was enabled and port 5900 was reachable from the internet; attackers had obtained root access and installed Monero cryptomining software on compromised machines.
Those details make configuration central to the risk assessment. Knowing that an organisation owns Macs says little on its own, whereas knowing that an affected Mac exposes Screen Sharing directly to the internet turns the question into a far more immediate one. Patch state, service configuration, and external reachability all need to be considered together.
At the same time, the reported outcomes should not be stretched beyond the evidence available. The Dutch NCSC has documented root access and cryptomining in incidents reported to it, but that does not establish ransomware deployment, data theft, espionage, or the involvement of a single threat actor across wider exploitation of the flaw.
Four vulnerabilities, four different exposure questions
What CISA’s 18 August update establishes is one important common factor: exploitation is no longer hypothetical. Beyond that shared status, the four vulnerabilities present markedly different risk calculations.
| Vulnerability | Primary issue | Exposure question |
|---|---|---|
| CVE-2026-33824 | Windows IKE remote code execution | Which affected systems expose the relevant service, and did the April fixes reach them? |
| CVE-2026-55040 | SharePoint authentication weakness | Which on-premises SharePoint Server farms remain vulnerable, and what sits behind them? |
| CVE-2026-59310 | vCenter arbitrary code execution | Who can reach the management layer, and what infrastructure does it administer? |
| CVE-2026-65400 | Screen Sharing authentication bypass | Is Screen Sharing enabled on an affected Mac and reachable from the internet? |
Seen together, the four cases expose a limitation in vulnerability management that no single severity score can solve. A scanner can establish that vulnerable software is present, CVSS can describe characteristics of the flaw, and KEV can add evidence that attackers are exploiting it. None of those signals automatically captures the role a particular asset plays inside an organisation.
An internet-exposed remote-access service, a SharePoint farm containing sensitive corporate records, and a vCenter instance administering production infrastructure may all be vulnerable, but the consequences of compromise differ substantially. Reachability, authentication, privilege, network position, business dependency, and compensating controls are what turn vulnerability data into a meaningful picture of organisational risk.
That additional context becomes more important as patch queues grow. An April Windows fix still missing from a network-facing system, an exposed SharePoint farm, a vulnerable vCenter management layer, and an internet-accessible Mac running Screen Sharing do not deserve attention simply because their CVE numbers appear in the same CISA update; they deserve attention because active exploitation now intersects with specific architectural weaknesses and operational dependencies.
All four vulnerabilities have therefore earned renewed scrutiny, but the fastest remediation decision will not necessarily come from comparing the largest numbers beside their CVE records. It will come from knowing where each affected system sits, who can reach it, what authority it carries, and what successful compromise would unlock.
