CISA Warns of Active Exploitation of Critical macOS, SharePoint, vCenter Flaws

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming that threat actors are actively exploiting them in real-world attacks. The flaws span Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft Internet Key Exchange (IKE) Service Extensions, with CVSS scores ranging from 9.1 to 9.8. CVE-2026-65400 is an improper authentication flaw in macOS Screen Sharing that allows network-based attackers to authenticate without valid credentials. CVE-2026-55040 enables security feature bypass on SharePoint over the network, while CVE-2026-59310 is a path traversal vulnerability in vCenter permitting arbitrary code execution. CVE-2026-33824, a double-free flaw in Microsoft IKE, similarly enables remote code execution. Federal Civilian Executive Branch (FCEB) agencies have until August 21, 2026, to remediate these issues per BOD 26-04 guidelines, but organizations across all sectors should treat them with equal urgency given the observed exploitation patterns.

The exploitation activity reveals a layered threat landscape. The macOS flaw has been weaponized to deploy a Monero cryptocurrency miner on compromised endpoints, while the SharePoint vulnerability has been abused by unknown actors following the public release of a proof-of-concept (PoC) exploit. The vCenter flaw is assessed to have been leveraged by a suspected China-nexus advanced persistent threat (APT) group to install backdoors and reverse_ssh binaries for persistent access, with at least one incident culminating in the deployment of Babuk-derived ransomware. According to reporting, the combined campaign has compromised 361 unique victim IP addresses across 47 countries, with the heaviest infection concentrations in Germany (55), the United States (41), Turkey (38), Iran (26), and France (25). Palo Alto Networks Unit 42 has additionally linked CVE-2026-33824 to a separate Chinese-speaking threat actor that simultaneously ran an AI-enabled autonomous hacking campaign using DeepSeek alongside manual exploitation of known vulnerabilities.

The convergence of nation-state operations, ransomware deployment, and AI-assisted exploitation underscores how quickly adversaries are operationalizing newly disclosed flaws. Defenders should prioritize patching vCenter, SharePoint, and IKE-exposed hosts immediately, then audit authentication logs for the macOS Screen Sharing bypass. Network defenders can verify exposure of vulnerable services using a port scanner to identify publicly reachable vCenter, IKE, and SharePoint endpoints, while remote access hygiene should be validated with a VPN/proxy detector to surface anonymized connections from threat actors. Organizations should also run a privacy checkup on endpoints to identify lingering footholds from the observed reverse_ssh persistence mechanism, and rotate any credentials that may have transited the compromised authentication paths.