The US Cybersecurity and Infrastructure Security Agency added four vulnerabilities to its Known Exploited Vulnerabilities catalog on August 18, 2026, covering products from Microsoft, Broadcom and Apple that together run inside the vast majority of US enterprise networks.
Four flaws, all confirmed exploited
The four vulnerabilities are CVE-2026-33824, a double-free flaw in Microsoft Internet Key Exchange (IKE) Service Extensions; CVE-2026-55040, a weak authentication bug in Microsoft SharePoint; CVE-2026-59310, a path traversal vulnerability in Broadcom VMware vCenter; and CVE-2026-65400, an improper authentication flaw in Apple macOS. CISA states that these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
All four entries score 9.1 or higher on the CVSS severity scale. Three carry a critical 9.8 rating, covering Windows IKE, VMware vCenter and macOS. The SharePoint flaw scores 9.1.
CISA added all four to the KEV catalog on August 18, 2026, with a remediation due date of August 21, 2026 for covered federal systems. The due date binds Federal Civilian Executive Branch agencies, not private companies, but a KEV listing signals active exploitation.
How each flaw works
The SharePoint bug allows an unauthenticated attacker to forge a valid authentication token against on-premises SharePoint Server, bypassing security controls entirely. It does not affect SharePoint Online in Microsoft 365.
SharePoint’s token validation accepted tokens signed with the algorithm set to “none,” a bypass technique documented over a decade ago and formally deprecated by the IETF in 2020. An attacker can forge a token referencing SharePoint’s own certificate, and the server accepts it without checking the signature, granting access as a site user or full administrator.
Alongside that disclosure, Rapid7 and Microsoft published CVE-2026-63520, a high-severity remote code execution flaw in Microsoft SharePoint. Discovered by Rapid7 Senior Principal Security Researcher Stephen Fewer and published in coordination with Microsoft, this vulnerability is the second in a pair of exploits which, when chained together, comprise a critical unauthenticated remote code execution vulnerability on a vulnerable SharePoint server. Alongside the coordinated disclosure of CVE-2026-63520, Rapid7 also published a detailed technical analysis and proof-of-concept for CVE-2026-55040, the first vulnerability in the chain.
The agency’s separate SharePoint hardening alert updated on August 18 now lists six distinct SharePoint CVEs under active exploitation in 2026. CISA is aware of active exploitation of vulnerabilities CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522, and CVE-2026-55040, enabling cyber threat actors to gain unauthorized access to on-premises SharePoint Server instances. These vulnerabilities affect all supported on-premises SharePoint Server versions and involve establishing remote code execution and post-exploitation activities, such as stealing IIS machine keys and performing deserialization techniques, to gain persistence and deploy malware.
The Windows IKE flaw is a memory corruption bug in the service that manages IPsec VPN handshakes. An unauthenticated attacker can send a malformed packet to corrupt memory and potentially execute code remotely.
The vCenter entry, CVE-2026-59310, is a path traversal vulnerability in Broadcom VMware vCenter that could allow a threat actor with network access to execute arbitrary code. A suspected advanced persistent threat actor was exploiting the vCenter flaw within five days of its disclosure, with hundreds of servers across dozens of countries reported compromised within days.
The shrinking patch window
The week’s security headlines illustrate a troubling pattern: the time between vulnerability disclosure and active exploitation has collapsed to just days. Rapid7 released its CVE-2026-55040 write-up and proof-of-concept on August 11; threat intelligence sources reported that exploitation attempts using that proof-of-concept followed within hours.
The one actively exploited zero-day patched in August’s Patch Tuesday, CVE-2026-68820, affects the Windows Ancillary Function Driver for WinSock and can enable elevation of privilege on an affected device. That pattern is consistent with what security researchers describe as exploit development timelines compressing across the industry.
CISA is aware of active exploitation of multiple SharePoint vulnerabilities, enabling cyber threat actors to gain unauthorized access to on-premises SharePoint Server instances.
What organizations should do now
Microsoft released patches for the IKE and SharePoint vulnerabilities in their August update cycle. VMware and Apple have issued corresponding updates for their respective vulnerabilities.
A vulnerability reaches the KEV catalog because it is being exploited, which means the relevant question is not only whether an organization is still exposed but whether it was exposed while the flaw was being used. For an internet-reachable vCenter or SharePoint server, that means reviewing authentication logs and looking for accounts and scheduled tasks created in the exposure window.
Organizations should also check for persistence mechanisms before closing the ticket.
The August Patch Tuesday cycle addressed 421 CVEs, including 236 in Windows alone. While this Patch Tuesday is not as large as last month’s, which fixed 570 flaws, it is still very large by historical comparison.
For enterprise IT teams managing both cloud and on-premises stacks, the workload mirrors pressures seen across the software industry, where tools such as Git 2.55’s new parallel hooks are designed to help developers move faster without sacrificing control. CISA’s 24/7 Operations Center can be reached at [email protected] for organizations that detect anomalous activity linked to any of the four catalogued flaws.
