The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating that federal agencies patch them by August 21, 2026. The newly cataloged flaws affect Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft Internet Key Exchange (IKE) Service Extensions.
One of the critical vulnerabilities, CVE-2026-33824, is a double-free remote code execution flaw in Windows IKE Service Extensions, carrying a CVSS score of 9.8. This vulnerability could allow remote attackers to execute arbitrary code on systems where IKE is enabled. While blocking UDP ports 500 and 4500 can mitigate external threats, internal attackers could still exploit it for lateral movement, necessitating prompt patching.
Another significant entry is CVE-2026-55040, an authentication bypass in Microsoft SharePoint Server Subscription Edition with a CVSS score of 9.1. This flaw allows an unauthenticated attacker to forge JSON Web Tokens (JWTs) and impersonate any SharePoint user, including administrators. The exploit chain leverages a combination of weaknesses in JWT validation, including the ability to specify "alg: none" in the outer header to bypass signature requirements and misuse SharePoint's own STS certificate thumbprint. Researchers from Defused observed attackers actively exploiting this vulnerability against honeypots using a proof-of-concept developed by Rapid7.
Broadcom VMware vCenter is affected by CVE-2026-59310, a path traversal vulnerability in the Syslog server, also rated with a critical CVSSv3 base score of 9.8. This flaw enables a malicious actor with network access to vCenter to execute arbitrary code on the system.
Finally, CVE-2026-65400 addresses an improper authentication vulnerability in Apple macOS's built-in Screen Sharing feature. This flaw, which has no CVSS score provided, could allow an attacker on the network to authenticate to Screen Sharing without valid credentials. Apple released patches for this issue on August 15, 2026, with macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. The Dutch National Cyber Security Centre confirmed active exploitation of this vulnerability less than two weeks after Apple issued the fix. Apple credited researcher Alfredo Pesoli of Bynario Atlas for discovering the flaw.
CISA's Binding Operational Directive (BOD) 22-01 requires all Federal Civilian Executive Branch (FCEB) agencies to remediate vulnerabilities listed in the KEV catalog by specified due dates to protect their networks. CISA also strongly recommends that private sector organizations review the catalog and address these vulnerabilities within their own infrastructures.
