CISA's addition of four vulnerabilities to the Known Exploited Vulnerabilities catalog on August 18, 2026 is particularly noteworthy because the vulnerabilities affect four very different but highly valuable parts of modern enterprise infrastructure: Windows VPN and IPsec services, Microsoft SharePoint, VMware vCenter and macOS Screen Sharing. What connects them is more important than the individual technologies involved. All four vulnerabilities have moved beyond theoretical severity scores and are now backed by evidence of exploitation in the wild. CISA has therefore placed CVE-2026-33824, CVE-2026-55040, CVE-2026-59310 and CVE-2026-65400 in the KEV catalog, with a remediation deadline of August 21, 2026 for affected U.S. federal civilian agencies.

CVE-2026-33824: Microsoft Windows IKE Service Extensions double-free vulnerability

CVE-2026-33824 is arguably the most immediately concerning vulnerability in the group because it affects the Windows Internet Key Exchange service, a component directly associated with IPsec and VPN communication. The vulnerability is a double-free memory corruption issue in Windows IKE Extensions. An unauthenticated remote attacker can exploit the flaw over the network to execute arbitrary code, with no user interaction required. The CVSS 3.1 vector reflects precisely the combination defenders dislike seeing: network accessible, low attack complexity, no privileges required, no user interaction and high impact to confidentiality, integrity and availability.

The positioning of IKE makes this particularly important. Organisations deliberately expose VPN gateways and IPsec endpoints because their entire purpose is to accept connections from outside the trusted network. A remotely exploitable vulnerability in the service processing those negotiations therefore attacks the security boundary itself. An attacker does not necessarily need compromised VPN credentials if the component responsible for establishing the secure tunnel can itself be attacked before authentication has taken place. Microsoft originally patched the vulnerability in its April 2026 security updates, but CISA's August KEV addition confirms that exploitation has now been observed in the wild.

The vulnerability also illustrates why network-edge services deserve a much shorter patching cycle than ordinary endpoints. VPN gateways, firewalls, remote-access services and identity gateways are designed to be reachable by untrusted users. Once a remotely exploitable vulnerability becomes public, attackers can systematically scan the Internet for exposed instances rather than having to identify individual victims first. Organisations running Windows systems that terminate IKE or IPsec connections should therefore verify that the relevant Microsoft security updates have actually been installed, rather than assuming normal Windows patching processes have covered every server.

From a security-monitoring perspective, defenders should also pay attention to unusual IKE negotiation behaviour, malformed or abnormal IKE traffic, repeated connection attempts against UDP ports commonly associated with IPsec, and unexpected processes or outbound connections originating from systems providing VPN services. The larger lesson is straightforward: a VPN is itself an Internet-facing application. Treating it merely as the mechanism that protects other applications ignores the fact that it has become one of the highest-value attack surfaces in the organisation.

CVE-2026-55040: Microsoft SharePoint weak authentication vulnerability

CVE-2026-55040 affects Microsoft Office SharePoint and is classified as a weak-authentication vulnerability. Microsoft describes the flaw as allowing an unauthorised attacker to bypass a security feature over a network. Its CVSS characteristics indicate that exploitation can occur remotely, with low complexity, without privileges and without user interaction, and can result in high confidentiality and integrity impact.

SharePoint vulnerabilities deserve particular attention because SharePoint servers frequently contain far more than ordinary web content. They may hold internal documents, contracts, employee information, project records, intellectual property and credentials or configuration material inadvertently stored by users. They are also deeply integrated with enterprise identity and collaboration environments. A weakness that allows an attacker to bypass authentication or another security boundary can therefore become an entry point into an extremely valuable repository of organisational information.

This vulnerability also arrives against the backdrop of significant exploitation activity involving on-premises SharePoint during 2026. Other SharePoint vulnerabilities disclosed this year have included missing authentication and unsafe deserialization flaws capable of privilege escalation or remote code execution. For example, CVE-2026-58644 is an unauthenticated deserialization vulnerability capable of remote code execution, while CVE-2026-56164 involves missing authentication for a critical function. The repeated targeting of SharePoint should therefore push organisations away from treating these vulnerabilities as isolated patching events and toward treating Internet-facing SharePoint as a continuously targeted asset.

For defenders, patching CVE-2026-55040 should be accompanied by retrospective investigation. If a server was exposed while vulnerable, administrators should examine IIS and SharePoint logs for unusual requests, authentication anomalies, unexpected account activity, suspicious file creation and abnormal access to sensitive sites. This distinction is important because patching prevents future exploitation but cannot undo exploitation that occurred yesterday. Vulnerability management and incident investigation are separate activities, despite the industry's persistent temptation to pretend that installing an update somehow rewrites history.

CVE-2026-59310: Broadcom VMware vCenter directory traversal leading to arbitrary code execution

CVE-2026-59310 is perhaps the most strategically dangerous vulnerability of the four because it affects VMware vCenter, the management plane responsible for controlling virtual infrastructure. Broadcom describes the flaw as a directory traversal vulnerability in the vCenter Syslog server. A malicious actor with network access to vCenter may exploit it to execute arbitrary code. Broadcom rates the vulnerability Critical with a maximum CVSS v3 score of 9.8, and importantly, there is no workaround. Administrators must install the relevant patched version.

A directory traversal vulnerability can sometimes sound less dramatic than remote code execution, but CVE-2026-59310 demonstrates why vulnerability names alone can be misleading. The underlying path-handling weakness ultimately enables arbitrary code execution. The CVSS vector again shows network accessibility, low attack complexity, no required privileges and no user interaction, with complete potential impact to confidentiality, integrity and availability.

The location of this vulnerability makes the risk substantially greater. vCenter is not simply another server. It is the administrative control plane for potentially hundreds or thousands of virtual machines. A successful compromise could therefore give attackers an exceptionally powerful position from which to investigate the virtual environment, steal credentials, interfere with workloads, establish persistence or prepare further attacks against the infrastructure.

This has obvious implications for ransomware. Virtualisation environments have become attractive targets because disabling or encrypting a relatively small number of hypervisor systems can disrupt enormous numbers of workloads simultaneously. An attacker who gains control of the virtualisation management plane does not necessarily need to compromise every virtual machine individually. The architecture has thoughtfully centralised administration for legitimate operators and, unfortunately, may do the same for attackers who capture that administrative layer.

Broadcom's advisory lists patched vCenter versions including 9.1.0.0300 for the 9.1 branch and 9.0.2.0100 for the 9.0 branch, and states that there is no workaround for CVE-2026-59310. Organisations should therefore verify their exact vCenter release against Broadcom's response matrix rather than relying on network filtering as a substitute for remediation.

The security architecture around vCenter is equally important. vCenter management interfaces should not ordinarily be directly exposed to the Internet and should be reachable only from specifically authorised administrative networks, jump hosts or management systems. Network segmentation cannot repair vulnerable software, but it can substantially reduce who is capable of reaching the vulnerable service. Monitoring should also look for unexpected connections to vCenter, unusual Syslog-related activity, file-system changes, newly created administrative accounts and anomalous actions against virtual machines.

CVE-2026-65400: Apple macOS Screen Sharing improper authentication vulnerability

CVE-2026-65400 affects the Screen Sharing functionality in macOS. Apple states that an attacker on the network may be able to authenticate to Screen Sharing without valid credentials. The underlying issue relates to authentication state management, which Apple addressed by improving how that state is handled. The vulnerability has been fixed in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9.

This flaw is interesting because it attacks one of the fundamental assumptions behind remote administration: that possession of valid credentials separates an authorised remote user from everyone else on the network. If an attacker can authenticate to Screen Sharing without those credentials, the security boundary protecting interactive access to the system can potentially collapse.

Its practical risk depends heavily on reachability. A Mac with Screen Sharing disabled or inaccessible to an attacker presents a very different exposure than a Mac with the service reachable across a corporate network, VPN environment or poorly segmented network. Organisations should therefore not only install Apple's August 6 security updates but also inventory where Screen Sharing is enabled and determine whether those systems genuinely require remote access.

This vulnerability also demonstrates why lateral movement deserves as much attention as Internet-facing exposure. An attacker who initially compromises one workstation may subsequently scan the internal network looking for other remote administration services. A vulnerability that requires only network access can become extremely useful at that stage. Internal networks therefore cannot be treated as automatically trusted zones simply because they sit behind a firewall. Segmentation between users, servers and management services, combined with controls governing which devices can initiate remote-management connections, can significantly reduce the usefulness of such vulnerabilities to an attacker.

Taken together, these four vulnerabilities provide a useful snapshot of the modern attack surface. CVE-2026-33824 targets the remote-access perimeter, CVE-2026-55040 attacks a collaboration and data platform, CVE-2026-59310 compromises the virtualisation management plane, and CVE-2026-65400 targets endpoint remote administration. Different products, different operating systems and different vulnerability classes, yet the attacker objective remains remarkably consistent: bypass the security boundary that stands between network access and privileged control.

There is also an important vulnerability-management lesson in CISA's August 18 update. CVSS tells organisations how technically severe a vulnerability could be, whereas KEV inclusion tells them something arguably more operationally useful: somebody is actually exploiting it. CVE-2026-33824 was originally disclosed and patched in April, CVE-2026-55040 appeared in July, CVE-2026-59310 was disclosed at the end of July, and CVE-2026-65400 was patched by Apple on August 6. Their addition to KEV on August 18 demonstrates that an older vulnerability does not become harmless merely because a patch has existed for several months. Unpatched systems effectively become more attractive over time as attackers improve their tooling and defenders mistakenly lower their attention.

Organisations should therefore use CISA KEV as an exploitation-driven prioritisation layer rather than relying exclusively on CVSS scores. The first question should be whether an affected asset exists, the second whether attackers can reach it, the third whether it has been patched, and the fourth whether there is evidence that exploitation may already have taken place. For critical management infrastructure such as vCenter, SharePoint or VPN services, remediation should also include compromise assessment because installing the patch closes a vulnerability but does not remove persistence, stolen credentials or malicious changes established before the patch was applied.

The broader lesson from these four CVEs is that security controls cannot operate independently. Patch management reduces exposure, segmentation limits reachability, least privilege restricts what a successful compromise can achieve, behavioural monitoring identifies abnormal activity, and threat intelligence tells defenders which vulnerabilities attackers have actually decided are worth exploiting. Remove any one of those layers and the organisation becomes considerably more dependent on the others.

CISA's KEV catalog is therefore becoming one of the most useful operational signals available to security teams. Vulnerability databases tell us what might be exploited; KEV increasingly tells us what attackers have already chosen to exploit. When vulnerabilities affecting VPN services, collaboration platforms, virtualisation control planes and remote desktop functionality all appear in the same update, the message is difficult to miss: attackers are targeting the infrastructure that provides access and control, because compromising the control point is often far more efficient than attacking every system behind it individually.

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-33824 Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability CVE-2026-55040 Microsoft SharePoint Weak Authentication Vulnerability CVE-2026-59310 Broadcom VMware vCenter Path Traversal Vulnerability CVE-2026-65400 Apple macOS Improper Authentication Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities

Source: CISA Adds Four Known Exploited Vulnerabilities to Catalog via CISA Advisories — published 18 Aug 2026.