CISA puts a SharePoint token-forgery chain and a Windows IKE bug on the federal clock

CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on evidence of active exploitation: a Microsoft IKE Service Extensions double free, a Microsoft SharePoint weak authentication bug, a Broadcom VMware vCenter path traversal, and an Apple macOS improper authentication flaw ^[1][2]. Federal civilian agencies have been ordered to fix them by August 21, 2026, according to Security Affairs ^[13].

The SharePoint issue, CVE-2026-55040, is the one that should reorder your morning. Rapid7 describes it as a critical authentication bypass in SharePoint Server Subscription Edition's JWT token validation pipeline, with a root cause that is not one bug but a chain of four distinct weaknesses that together let an unauthenticated remote attacker forge a valid JWT and impersonate any SharePoint site user ^[6]. That includes administrators, with no credentials required ^[5]. The mechanics are unglamorous and cheap: an outer header of "alg: none" so no signature is demanded, SharePoint's own STS certificate thumbprint used to resolve a signing key without verification, and a signature field that is non-empty but never verified, such as "AAAA" ^[7]. Nothing in that sequence needs custom tooling or a stolen secret.

It is already being used. Defused researchers observed attackers running the Rapid7 proof of concept for CVE-2026-55040 against their honeypots ^[8]. When the public POC is the observed attack tooling, the window between disclosure and opportunistic scanning is effectively zero.

The Windows entry, CVE-2026-33824, is where the paperwork and the reality diverge slightly. CISA catalogues it as an Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability ^[2]; Security Affairs describes the same CVE as a critical remote code execution flaw in Windows IKE service extensions that could let remote attackers execute code on affected systems ^[3]. Blocking UDP ports 500 and 4500 reduces exposure from external threats, but internal attackers may still exploit it for lateral movement, which is why rapid patching is recommended rather than perimeter filtering alone ^[4].

The vCenter flaw, CVE-2026-59310, is a directory traversal in the Syslog server that Broadcom rates critical with a maximum CVSSv3 base score of 9.8, allowing a malicious actor with network access to vCenter to execute arbitrary code ^[9]. The macOS flaw, CVE-2026-65400, sits in the Screen Sharing feature built into every Mac, and per Apple's advisory an attacker on the network may be able to authenticate to Screen Sharing without valid credentials ^[10]. Apple's fix improved how the system manages authentication state ^[19] and shipped in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, crediting researcher Alfredo Pesoli at Bynario Atlas ^[12]. The Dutch National Cyber Security Centre confirmed active exploitation on August 15, 2026, less than two weeks after Apple shipped that fix ^[11] and six days before the federal deadline ^[17].

The governing instrument has changed, and that matters for how agencies triage. CISA points to Binding Operational Directive 26-04, which requires FCEB agencies to prioritise rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control of the asset post-exploitation, while deferring lower-risk work, and which sets expectations for checking whether attackers compromised a system before the patch landed ^[14]. Security Affairs still frames the obligation under the older BOD 22-01 due-date model ^[16]. Either way, 26-04 binds only FCEB agencies, with everyone else merely encouraged ^[15].

Watch whether the SharePoint compromise-assessment expectation under BOD 26-04 produces disclosed intrusions rather than just patch counts ^[14], and whether exploitation of CVE-2026-55040 moves beyond honeypot hits on the Rapid7 POC into named victims ^[8].