THE U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added several vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, notably impacting Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE. The vulnerabilities include: 1. **CVE-2026-33824 (CVSS: 9.8)** - A remote code execution flaw in Microsoft IKE service that can be exploited through enabled UDP ports 500 and 4500.
2. **CVE-2026-55040 (CVSS: 9.1)** - An authentication bypass vulnerability in Microsoft SharePoint allowing unauthorized token forging to impersonate users. 3. **CVE-2026-59310 (CVSS: 9.8)** - A critical path traversal vulnerability in VMware vCenter enabling arbitrary code execution. 4. **CVE-2026-65400 (CVSS: Unspecified)** - An improper authentication flaw in macOS's Screen Sharing tool, allowing network attackers to authenticate without valid credentials.
CISA has mandated federal agencies to address these vulnerabilities by August 21, 2026, and is advising private organizations to review the catalog and take necessary actions.