Published · 4d agoSecurity2 min read
Four new KEV entries, one deadline, and a campaign the catalog cannot count
CISA added four exploited flaws in Microsoft, VMware and Apple products to its catalog, with a August 21 federal deadline. What the number measures is patchable exploitation, not risk.
Not a builder's beat, but builders have a standing stake in it.See today for builders
What happened
- CISA on Tuesday called for immediate patching of four vulnerabilities in Microsoft, VMware and Apple products that have been exploited in the wild, adding all four to its Known Exploited Vulnerabilities catalog.
- CVE-2026-33824 (CVSS 9.8) is a double free issue in the Windows Internet Key Exchange (IKE) Service Extension; CVE-2026-55040 (CVSS 9.1) is a weak authentication flaw in SharePoint.
- The Windows IKE Extension defect was patched in April and allows remote, unauthenticated attackers to execute arbitrary code via specially crafted packets.
- At the end of July, Palo Alto Networks flagged the Windows IKE weakness as being exploited by a Chinese-speaking threat actor in an AI-enabled autonomous hacking campaign that also involved manual exploitation.
- Threat actors began targeting the SharePoint vulnerability, an authentication bypass fixed on Microsoft's July 2026 Patch Tuesday, earlier this month after a proof-of-concept exploit was published.
Compiled by The WatchSomething wrong?How this is made
Why it matters
Four is the number of vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog on Tuesday, across Microsoft, VMware and Apple products, all confirmed exploited in the wild [1]. Federal civilian agencies have until August 21 to remediate all four under BOD 26-04 [8], the directive issued June 10, 2026 that carries forward the KEV criteria from BOD 22-01 and binds FCEB agencies to prescribed remediation timeframes [9].
What the figure turns on is the entry threshold. A vulnerability lands in KEV only when it has a CVE ID, reliable evidence of active exploitation, and a clear remediation action such as a vendor update [10]. So four is a count of exploitation that is both proven and fixable, and it is offered as an input to prioritisation frameworks such as SSVC rather than as a picture of adversary activity [11].
The four themselves are mostly recent patches overtaken by attackers. VMware fixed CVE-2026-59310 in vCenter on July 29, and exploitation to drop an open source SSH reverse shell framework began August 3 [6], a gap of five days [12]. Apple patched the macOS Screen Sharing authentication bypass CVE-2026-65400 on August 6; exploitation for root access and a Monero miner followed in under a week [7]. Attackers moved on the SharePoint authentication bypass CVE-2026-55040 after a proof of concept was published [5]. The oldest, the Windows IKE Extension double free CVE-2026-33824, was patched in April and flagged at the end of July by Palo Alto Networks as exploited by a Chinese-speaking actor in an AI-enabled autonomous campaign [3][4]. Two of the four carry a CVSS score of 9.8 [13].
The limit of the number shows in what sits beside it. Ontinue's TWINLOOT implant, found during a July investigation, runs C2 through SharePoint Online, Teams TURN and a headless Edge browser making Graph calls [14][15], authenticating to an attacker-controlled Azure tenant so the victim's Entra ID logs record nothing [16]. There is no CVE and no patch, so there is no catalog entry.
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CISA on Tuesday called for immediate patching of four vulnerabilities in Microsoft, VMware and Apple products that have been exploited in the wild, adding all four to its Known Exploited Vulnerabilities catalog.
ReportedView cited source - [2]
CVE-2026-33824 (CVSS 9.8) is a double free issue in the Windows Internet Key Exchange (IKE) Service Extension; CVE-2026-55040 (CVSS 9.1) is a weak authentication flaw in SharePoint.
ReportedView cited source - [3]
The Windows IKE Extension defect was patched in April and allows remote, unauthenticated attackers to execute arbitrary code via specially crafted packets.
ReportedView cited source - [4]
At the end of July, Palo Alto Networks flagged the Windows IKE weakness as being exploited by a Chinese-speaking threat actor in an AI-enabled autonomous hacking campaign that also involved manual exploitation.
ReportedView cited source - [5]
Threat actors began targeting the SharePoint vulnerability, an authentication bypass fixed on Microsoft's July 2026 Patch Tuesday, earlier this month after a proof-of-concept exploit was published.
ReportedView cited source - [6]
The VMware vCenter bug CVE-2026-59310 (CVSS 9.8) was patched on July 29, and threat actors started exploiting it for code execution on August 3 to drop an open source SSH reverse shell framework.
ReportedView cited source
Sources & coverage · 3 publishers
The reporting this story was synthesized from, earliest first. Every link goes to the original.
- securityweek.com4d agoCISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities
- csoonline.com4d agoNew malware turns Microsoft cloud into its control center | CSO Online
