The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog with four critical security flaws that are currently being exploited. This update, announced on Tuesday, highlights vulnerabilities in widely used software systems, posing significant risks if left unaddressed.
Details of the Vulnerabilities
The vulnerabilities identified by CISA include an improper authentication flaw in Apple macOS, labeled CVE-2026-65400, with a CVSS score of 9.8. This flaw allows network-based attackers to gain unauthorized screen sharing access. Microsoft SharePoint is affected by CVE-2026-55040, a weakness in authentication mechanisms that could enable attackers to bypass security over a network, rated at 9.1 on the CVSS scale.
Broadcom VMware vCenter is susceptible to CVE-2026-59310, a path traversal vulnerability with a critical CVSS score of 9.8. This issue could allow attackers with network access to execute arbitrary code. Lastly, Microsoft Internet Key Exchange Service Extensions suffer from a double free vulnerability, CVE-2026-33824, also assessed at 9.8, permitting unauthorized code execution over a network.
Impact and Exploitation
Despite the release of patches by vendors, these vulnerabilities are actively being exploited. The macOS flaw has been used to deploy Monero cryptocurrency mining malware, while the SharePoint vulnerability was targeted following the release of a proof-of-concept code. The VMware vCenter vulnerability is reportedly being leveraged by a suspected China-linked advanced persistent threat (APT) to install backdoors and ransomware, affecting numerous systems globally.
The scope of exploitation is extensive, with 361 unique victim IP addresses compromised across 47 countries. Germany, the United States, Turkey, Iran, and France have reported the highest number of infections.
Response and Mitigation Measures
Palo Alto Networks Unit 42 has observed the exploitation of the Microsoft IKE vulnerability by another Chinese-speaking threat actor. This actor is noted for using AI-enhanced tools like DeepSeek to conduct autonomous hacking campaigns alongside manual operations. In response, Federal Civilian Executive Branch agencies are required to update affected systems by August 21, 2026, in accordance with BOD 26-04 patching guidelines to ensure robust protection.
Overall, these developments underscore the importance of timely patching and vigilant monitoring of network security to mitigate the risks posed by these critical vulnerabilities.
