Hackers Have Already Moved On Windows IKE, SharePoint, vCenter and macOS Flaws, CISA Warns
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four flaws to its Known Exploited Vulnerabilities (KEV) catalog on Tuesday, and the pattern behind all four is the same: each vendor shipped a patch weeks ago, yet attackers are already using the bugs in live operations.
The batch covers a remote code execution hole in Windows Internet Key Exchange (IKE) Service Extensions, a weak authentication issue in Microsoft SharePoint, a path traversal bug in Broadcom's VMware vCenter, and an authentication bypass in Apple's macOS Screen Sharing. Federal Civilian Executive Branch (FCEB) agencies have until Friday, August 21, to patch all four under Binding Operational Directive 26-04, which gives agencies three days to secure publicly exposed systems.
The Windows flaw with the widest blast radius
The most dangerous entry in the new list is tracked as CVE-2026-33824, a double-free vulnerability in the Windows IKE Service Extensions component that Microsoft patched during its April 2026 Patch Tuesday cycle. Microsoft's advisory describes it in plain terms: an unauthenticated attacker can send specially crafted packets to a Windows machine with IKE version 2 enabled and gain code execution over the network. BleepingComputer reported that CISA confirmed in-the-wild attacks even though Microsoft has not yet flagged the flaw as exploited in its own advisory.
The attack surface is what makes this one uncomfortable. The bug can be triggered by malicious packets arriving on UDP ports 500 or 4500, which are the standard ports for IPsec and IKE traffic. Every supported release of Windows 10, Windows 11, and Windows Server is affected. That means a device does not need to run exotic software or sit behind a misconfigured application to be reachable — it only needs to expose those ports to the wrong network.
Microsoft, which has not yet formally marked the flaw as exploited, recommends that teams unable to install the update immediately block inbound traffic on UDP 500 and 4500 on systems that do not use IKE, or restrict those ports to known peer addresses where IKE is required.
The same bug shows up in an AI-assisted campaign
The Windows IKE flaw is not just a catalog entry. Palo Alto Networks' Unit 42 research group tied CVE-2026-33824 to a Chinese-speaking threat actor who has been testing autonomous, AI-driven attack workflows. The actor, who operated under the aliases knaithe and KnYuan, wired a DeepSeek model into an agent framework and let it enumerate internet-facing targets, pull public proof-of-concept exploits, and launch attacks without human intervention.
Unit 42's report, published in late July, documented the AI operator scanning for vulnerable systems through the FOFA search engine, sampling roughly 100 of more than 25,000 exposed n8n instances in China, and probing about 40 unique addresses before finding three running vulnerable versions. In the same campaign, the actor's manual operations included reverse shell attempts against three IKE VPN endpoints using CVE-2026-33824, alongside data exfiltration from Citrix NetScaler appliances and command execution on Marimo notebook servers.
The campaign pushed against more than 460 targets in total. The AI portion never achieved a full compromise, largely because the targets it picked required configuration the victims had not enabled, but the workflow itself is the worrying part: an attacker with a permissive model and a few thousand dollars of API credits can now automate the target-selection and exploit-triaging work that used to take a team of humans days or weeks.
macOS: root access and a Monero miner
The macOS entry, CVE-2026-65400, is an authentication bypass in the Screen Sharing service, Apple's built-in remote desktop feature. Apple patched it on August 6 in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, after a Huntress analysis found that an error in the service's frame-length validation could return an outdated success status, letting an unauthenticated connection continue without the expected cryptographic handshake.
The Netherlands' National Cyber Security Centre (NCSC-NL) reported that attackers exploited the flaw on multiple internet-accessible Macs, obtained root-level access, and installed Monero cryptocurrency miners. The service normally listens on TCP port 5900, and the observed attacks hit systems with that port directly reachable from the internet. No valid macOS account, VNC password, or victim action is required to trigger the flaw, which carries a CVSS score of 9.8.
Screen Sharing is not enabled by default on standard Macs, which limits the risk for most home users. But hosted Mac mini and Mac Studio servers, build machines, and remotely managed workstations often have it switched on, and those are exactly the systems the attackers targeted. NCSC-NL has not said how many machines were compromised or when the attacks began.
SharePoint and vCenter round out the batch
The other two additions are familiar names to anyone tracking recent disclosures. CVE-2026-55040 is a weak authentication flaw in Microsoft SharePoint, scored 9.1, that lets an attacker bypass a security feature over the network. The Hacker News reported that unknown actors began exploiting it after public proof-of-concept code appeared.
CVE-2026-59310 is a path traversal vulnerability in Broadcom's VMware vCenter, scored 9.8, that allows a threat actor with network access to execute arbitrary code. The Hacker News attributed the exploitation to a suspected China-nexus advanced persistent threat group that deployed a backdoor and reverse SSH binaries on compromised instances, and in at least one case followed up with Babuk-derived ransomware on ESXi hosts. That campaign compromised 361 unique victim IP addresses across 47 countries, with infections concentrated in Germany, the U.S., Turkey, Iran, and France.
Readers who follow this site's Cybersecurity coverage will recognize the vCenter story: it was detailed here earlier this week when researchers first tied the two-week-old flaw to the China-linked intrusion wave.
What defenders should do now
The KEV catalog exists because exploited bugs are the ones that matter most, and CISA's three-day deadline for FCEB agencies reflects how quickly these four moved from patch-release to in-the-wild abuse.
For the Windows IKE bug, patching is the only real fix. Firewall rules on UDP 500 and 4500 help for systems that do not speak IKE, but the ports are legitimate for VPN and IPsec traffic, so teams that actually run those services cannot simply close them. Inventory which devices expose those ports to the internet or to untrusted segments, and treat that list as the patching priority queue.
Mac administrators should check whether Screen Sharing or Remote Management is enabled on any machine, especially hosted or build systems. The fix requires updating macOS itself; password changes and account restrictions do not stop exploitation of CVE-2026-65400. For systems already hit, removing the visible miner is not enough — an attacker with root can plant persistence that survives cleanup, so NCSC-NL and Bitdefender's threat researchers both recommend erasing and reinstalling macOS from a trusted source, then rotating credentials and API tokens from a clean device.
SharePoint and vCenter shops should confirm their patch status against the August advisories and assume that any publicly exposed instance is a candidate target. The vCenter campaign, in particular, shows what the attackers do after they get in: backdoors, SSH tunneling, and ransomware deployment on the hypervisor layer.
None of this is a drill, and the August 21 deadline is not just a government formality. The four bugs in this batch were exploited before CISA even announced them, which is exactly the scenario the catalog is designed to catch. The question for every organization running Windows, SharePoint, vCenter, or macOS is not whether the patches matter — it is whether the patches are installed.
There is also a timing lesson buried in this batch. Each of the four flaws was disclosed and patched between April and early August, which means the window between vendor fix and attacker exploitation is shrinking to weeks, sometimes days. The vCenter bug was exploited five days after Broadcom's update shipped, per The Hacker News. The macOS flaw was being used to mine crypto within days of Apple's August 6 patch. When a vendor tells you a patch is critical and that exploitation is possible without credentials, the reasonable move is to treat it as already compromised in the wild and patch on the same day, not at the next maintenance window.
For teams that want a quick check before the weekend: pull the KEV catalog, filter for the four CVEs named here, and confirm each asset class — Windows servers with VPN ports open, SharePoint farms, vCenter appliances, and internet-reachable Macs — appears in the patched column. Anything that does not should be treated as exposed until proven otherwise. CISA's catalog is updated whenever new evidence of active exploitation lands, and Tuesday's addition shows the agency is keeping pace with attackers who are not waiting for anyone.