The US Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday called for the immediate patching of four vulnerabilities in Microsoft, VMware, and Apple products that have been exploited in the wild.
CISA’s fresh warning refers to two Microsoft flaws, namely CVE-2026-33824 (CVSS score of 9.8), a double free issue in the Windows Internet Key Exchange (IKE) Service Extension, and CVE-2026-55040 (CVSS score of 9.1), a weak authentication flaw in SharePoint.
Patched in April, the Windows IKE Extension defect allows remote, unauthenticated attackers to execute arbitrary code via specially crafted packets.
At the end of July, Palo Alto Networks flagged the weakness as being exploited by a Chinese-speaking threat actor in an AI-enabled autonomous hacking campaign that also involved manual exploitation.
Threat actors started targeting the SharePoint vulnerability, an authentication bypass fixed on Microsoft’s July 2026 Patch Tuesday, earlier this month, after a proof-of-concept (PoC) exploit was published.
On Tuesday, CISA added both security defects to its Known Exploited Vulnerabilities (KEV) catalog, along with a recent VMware vCenter bug tracked as CVE-2026-59310 (CVSS score of 9.8), and a macOS Screen Sharing flaw tracked as CVE-2026-65400 (CVSS score of 7.5).
The VMware weakness was patched on July 29, and threat actors started exploiting it for code execution on August 3 to drop an open source SSH reverse shell framework.
Apple patched the macOS Screen Sharing issue on August 6, warning that it could allow attackers to bypass authentication and log into vulnerable devices without valid credentials.
In-the-wild exploitation was observed less than a week later. Threat actors were seen abusing it to gain root access and deploy a Monero miner.
CISA urges federal agencies to patch all four security defects by August 21, in line with BOD 26-04 recommendations.
Related: Oracle’s August 2026 Update Includes 943 Security Patches
Related: Chrome, Firefox Updates Patch Dozens of Vulnerabilities
Related: AI-Driven Vulnerability Surge Breaks the Traditional Patching Model
Related: 300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw
