Patch windows are short for four enterprise flaws CISA just added to its Known Exploited Vulnerabilities catalog. Federal agencies have until August 21 to remediate under Binding Operational Directive 26-04.
The August 18 catalog entries cover Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft Internet Key Exchange (IKE) Service Extensions. All four are already being exploited in the wild.
macOS Screen Sharing carries CVE-2026-65400, a CVSS 9.8 authentication gap. No valid credentials are needed for a network attacker to pass as an approved user, and live attacks have planted Monero miners. Apple’s fixes landed in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9.
SharePoint’s CVE-2026-55040 rates 9.1 and involves weak authentication. Once proof-of-concept code appeared, unknown actors began exploiting the security-feature bypass over the network.
vCenter’s CVE-2026-59310 (CVSS 9.8) is a path traversal giving network-reachable attackers arbitrary code execution. A suspected China-nexus APT has used it to plant backdoors and reverse_ssh binaries, with Babuk-derived ransomware seen in at least one case. The campaign touched 361 unique victim IPs across 47 countries, led by Germany, the US, Turkey, Iran, and France.
Microsoft’s IKE Service Extensions carry CVE-2026-33824, a CVSS 9.8 double free. Unit 42 tied exploitation to a Chinese-speaking actor running an AI-enabled autonomous campaign on DeepSeek alongside manual operations.
Vendors shipped patches before the catalog entries. CISA still urges all organizations to treat KEV-listed flaws on exposed systems as urgent.
