Critical Vulnerabilities in macOS, SharePoint, vCenter, and IKE Under Active Exploitation
Executive Summary
In August 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. These vulnerabilities include CVE-2026-65400 affecting Apple macOS, CVE-2026-55040 in Microsoft SharePoint, CVE-2026-59310 in VMware vCenter, and CVE-2026-33824 in Microsoft Internet Key Exchange (IKE) Service Extensions. Exploitation of these flaws has led to unauthorized access, deployment of cryptocurrency miners, backdoors, and ransomware attacks across multiple countries.
The active exploitation of these vulnerabilities underscores the persistent threat posed by sophisticated cyber actors targeting widely used enterprise systems. Organizations are urged to prioritize patching and implement robust security measures to mitigate potential risks associated with these exploits.
Why This Matters Now
The active exploitation of these critical vulnerabilities highlights the urgent need for organizations to update their systems and strengthen security protocols to prevent unauthorized access and potential data breaches.
Attack Path Analysis
Attackers exploited multiple critical vulnerabilities across various platforms to gain unauthorized access, escalate privileges, move laterally within networks, establish command and control channels, exfiltrate sensitive data, and deploy ransomware, leading to significant operational disruptions.
Kill Chain Progression
Initial Compromise
Description
Attackers exploited vulnerabilities such as CVE-2026-65400 in macOS Screen Sharing, CVE-2026-55040 in Microsoft SharePoint, CVE-2026-59310 in VMware vCenter, and CVE-2026-33824 in Microsoft IKE Service Extensions to gain unauthorized access to systems.
Related CVEs
CVE-2026-55040
CVSS 9.1Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
Affected Products:
Microsoft SharePoint – Affected versions not specified
Exploit Status:
exploited in the wildCVE-2026-59310
CVSS 9.8VMware vCenter contains a directory traversal vulnerability in the Syslog server, allowing a malicious actor with network access to execute arbitrary code.
Affected Products:
VMware vCenter – Affected versions not specified
Exploit Status:
exploited in the wildCVE-2026-33824
CVSS 9.8Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
Affected Products:
Microsoft Windows IKE Extension – Affected versions not specified
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Valid Accounts
Exploitation of Remote Services
Command and Scripting Interpreter
Create or Modify System Process
Data Encrypted for Impact
Application Layer Protocol
Impair Defenses
Remote Services
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components and software are protected from known vulnerabilities by installing applicable vendor-supplied security patches.
Control ID: 6.2
NYDFS 23 NYCRR 500 – Penetration Testing and Vulnerability Assessments
Control ID: 500.05
DORA – ICT Risk Management Framework
Control ID: Article 6
CISA ZTMM 2.0 – Asset Management
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Critical vulnerabilities in macOS, SharePoint, vCenter, and IKE services enable ransomware deployment, requiring immediate patching and enhanced zero-trust segmentation controls.
Government Administration
Federal agencies face August 21 patching deadline for exploited vulnerabilities affecting Screen Sharing, SharePoint, and vCenter systems under BOD 26-04 compliance.
Financial Services
Banking infrastructure vulnerable to lateral movement and data exfiltration through compromised vCenter and SharePoint systems, threatening PCI compliance requirements.
Health Care / Life Sciences
Healthcare organizations risk HIPAA violations from authentication bypass vulnerabilities enabling encrypted traffic interception and unauthorized access to patient data systems.
Sources
- Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitationhttps://thehackernews.com/2026/08/critical-macos-sharepoint-vcenter-and.htmlVerified
- CISA Adds Four Known Exploited Vulnerabilities to Cataloghttps://www.cisa.gov/news-events/alerts/2026/08/18/cisa-adds-four-known-exploited-vulnerabilities-catalogVerified
- NVD - CVE-2026-55040https://nvd.nist.gov/vuln/detail/CVE-2026-55040Verified
- NVD - CVE-2026-59310https://nvd.nist.gov/vuln/detail/CVE-2026-59310Verified
- NVD - CVE-2026-33824https://nvd.nist.gov/vuln/detail/CVE-2026-33824Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it would likely limit the attacker's ability to exploit vulnerabilities, escalate privileges, move laterally, establish command and control channels, exfiltrate data, and deploy ransomware, thereby reducing the overall blast radius.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to exploit these vulnerabilities would likely be constrained, reducing the scope of initial system compromises.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges would likely be constrained, reducing the scope of elevated access within compromised systems.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally across the network would likely be constrained, reducing the scope of additional system compromises.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish and maintain command and control channels would likely be constrained, reducing the scope of persistent access.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate sensitive data would likely be constrained, reducing the scope of data loss.
The attacker's ability to deploy ransomware and disrupt operations would likely be constrained, reducing the scope of operational disruptions.
Impact at a Glance
Affected Business Functions
- Network Security
- Data Integrity
- System Availability
Estimated downtime: 14 days
Estimated loss: $500,000
Potential exposure of sensitive corporate data and user credentials.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict lateral movement and limit the spread of attacks within the network.
- • Deploy East-West Traffic Security controls to monitor and control internal traffic, detecting and preventing unauthorized communications.
- • Utilize Egress Security & Policy Enforcement to control outbound traffic, preventing data exfiltration and unauthorized external communications.
- • Enhance Threat Detection & Anomaly Response capabilities to identify and respond to suspicious activities promptly.
- • Regularly update and patch systems to mitigate known vulnerabilities and reduce the attack surface.
