August 2026 KEV Surge: Critical Patch Priority for CVE-2026-65400, CVE-2026-55040, CVE-2026-59310 & CVE-2026-33824

Overview

On August 18, 2026, four critical, actively exploited vulnerabilities were added to the Known Exploited Vulnerabilities (KEV) Catalog in a single batch, each carrying a required remediation date of August 21, 2026 under BOD 26-04. The vulnerabilities span macOS, SharePoint, vCenter, and the Windows IKE service. All four are network-exploitable and require no authentication, while several carry critical CVSS assessments. CVE-2026-65400 has differing published scores, with a CVSS 3.1 score of 9.8 in CISA/NVD data.

CVE-2026-65400 - Apple macOS Screen Sharing

Vulnerability Name	Apple macOS Improper Authentication Vulnerability (Screen Sharing)
CVE ID	CVE-2026-65400
Severity	Critical
CVSS Score	9.8 (CISA/NVD, CVSS 3.1)
CWE	CWE-287: Improper Authentication
Affected Products / Versions	macOS Tahoe (prior to 26.6.1), macOS Sequoia (prior to 15.7.9), macOS Sonoma (prior to 14.8.9)
Discovered By	Alfredo Pesoli (@__rev), Bynario Atlas
Published Date	August 6, 2026
Description	An authentication issue in Screen Sharing's session-state handling was addressed with improved state management. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

CVE-2026-55040 - Microsoft SharePoint

Vulnerability Name	Microsoft SharePoint Weak Authentication Vulnerability
CVE ID	CVE-2026-55040
Severity	Critical
CVSS Score	9.1 (CVSS 3.1)
CWE	CWE-1390: Weak Authentication
Affected Products / Versions	SharePoint Enterprise Server 2016, SharePoint Server 2019, SharePoint Server Subscription Edition (build ranges below)
Discovered By	Stephen Fewer, Rapid7; demonstrated at Pwn2Own Berlin
Published Date	July 14, 2026 (NVD published date)
Description	SharePoint's authentication of "actor tokens" used in server-to-server and workflow contexts is insufficiently validated, allowing an unauthorized network attacker to bypass a security feature.

CVE-2026-59310 - VMware vCenter

Vulnerability Name	Broadcom VMware vCenter Path Traversal Vulnerability
CVE ID	CVE-2026-59310
Severity	Critical
CVSS Score	9.8 (CVSS 3.1)
CWE	CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products / Versions	VMware vCenter 9.1.x, 9.0.x, 8.0.x (all updates prior to fixed builds); VMware Cloud Foundation and vSphere Foundation (bundled vCenter); VMware Telco Cloud Platform / Infrastructure (bundled vCenter)
Discovered By	Phil Brass and Matt South, Atredis Partners
Published Date	July 29, 2026 (VMSA-2026-0006 initial publication); NVD published July 30, 2026
Description	VMware vCenter's Syslog server does not adequately restrict file-path input, allowing a network-connected attacker to traverse the filesystem and ultimately execute arbitrary code.

CVE-2026-33824 - Microsoft Windows IKE Extension

Vulnerability Name	Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
CVE ID	CVE-2026-33824
Severity	Critical
CVSS Score	9.8 (CVSS 3.1)
CWE	CWE-415: Double Free
Affected Products / Versions	Multiple Windows 10 and Windows 11 versions and corresponding Windows Server releases (see table below); consult Microsoft's Security Update Guide for the complete product matrix.
Discovered By	Unavailable
Published Date	April 14, 2026 (NVD published date)
Description	A double-free memory-corruption flaw in the Windows IKE (Internet Key Exchange) service extension allows an unauthenticated, remote attacker to execute code on the target system.

Exploit Maturity Assessment

CVE-2026-65400 - Apple macOS Screen Sharing

The Screen Sharing flaw has moved beyond a theoretical authentication weakness: public PoC material exists and exploitation has been observed on internet-reachable macOS systems. The exploit abuses the service's authentication state handling rather than requiring valid account credentials, which lowers the barrier to exploitation where Screen Sharing is exposed.

Factor	Assessment
Exploit Status	Public PoC available; confirmed in-the-wild exploitation
Exploit Availability	Public
Source of Exploit	Public PoC referenced by NCSC-NL and vulnerability-disclosure sources associated with CVE-2026-65400
Exploit Reliability	Operationally demonstrated, but no formal reliability or exploit success-rate assessment has been published

CVE-2026-55040 - Microsoft SharePoint

A functional public PoC is available for CVE-2026-55040, and exploitation has also been confirmed in the wild. Rapid7 demonstrated the authentication bypass in a research environment, while CISA KEV confirms operational exploitation.

Factor	Assessment
Exploit Status	Functional public PoC available; confirmed in-the-wild exploitation
Exploit Availability	Public
Source of Exploit	Rapid7 researcher-published exploit repository and accompanying technical analysis
Exploit Reliability	Working exploitation demonstrated by Rapid7; no formal quantified reliability or success-rate assessment has been published

CVE-2026-59310 - VMware vCenter

The vCenter issue has reached operational exploitation and has a documented technical attack path. The weakness begins in Syslog path handling and can be extended into attacker-controlled file placement and privileged command execution. Current reporting also links exploitation to a broader campaign with persistent remote access and ransomware activity on some affected environments, increasing the urgency for exposed vCenter infrastructure.

Factor	Assessment
Exploit Status	Confirmed in-the-wild exploitation
Exploit Availability	PoC-level exploitation evidence exists; no vendor-provided exploit code
Source of Exploit	PoC and exploitation evidence reflected in NVD/CISA-ADP metadata; Broadcom documents the exploitable condition
Exploit Reliability	Operational exploitation confirmed, but exploit stability, repeatability, and success rate are not formally documented

CVE-2026-33824 - Microsoft Windows IKE Extension

CVE-2026-33824 is actively exploited against reachable Windows IKE/IPsec services. The bug is a remotely triggerable double-free condition, so successful exploitation depends on converting memory corruption during IKE processing into stable code execution; operational attacks have been observed even though public PoC material remains incomplete.

Factor	Assessment
Exploit Status	Confirmed in-the-wild exploitation
Exploit Availability	Operational exploitation documented; canonical public PoC repository not established in authoritative Microsoft/NVD records
Source of Exploit	Unit 42 documented exploitation against Windows IKE VPN endpoints; CISA KEV independently confirms exploitation
Exploit Reliability	Operationally demonstrated against real targets, but no authoritative formal reliability or success-rate assessment is available

Proof of Concept

CVE-2026-65400 - Apple macOS Screen Sharing

Public PoC code is available for CVE-2026-65400. NCSC-NL explicitly confirmed the availability of public PoC code and subsequently reported active exploitation against internet-exposed Screen Sharing systems.

Publicly Available	Yes - NCSC-NL confirms that public proof-of-concept code is available.
Description	Demonstrates exploitation of the macOS Screen Sharing authentication flaw that can allow network attackers to gain access without valid credentials. NCSC-NL later observed exploitation on systems exposing TCP port 5900 to the internet.

CVE-2026-55040 - Microsoft SharePoint

A functional researcher-published PoC is publicly available for CVE-2026-55040. Rapid7 released a Python exploit that demonstrates the SharePoint JWT authentication bypass and can impersonate SharePoint users.

Publicly Available	Yes - functional public PoC code is available.
Description	The Python PoC demonstrates the SharePoint authentication bypass by forging JWT authentication tokens. It supports discovery of target authentication parameters and impersonation of SharePoint users, including privileged accounts.

CVE-2026-59310 - VMware vCenter

Atredis Partners published detailed technical reproduction information for CVE-2026-59310. The research describes how crafted Syslog messages can be used to place attacker-controlled content on the vCenter appliance and ultimately obtain code execution as root.

Publicly Available	Yes - detailed researcher-published exploitation methodology is publicly available.
Description	The research documents an unauthenticated exploitation path involving the vCenter Syslog service. An attacker able to send Syslog traffic and reach the vmware-pod service can cause attacker-controlled content to be sourced by a root-executed shell process, resulting in arbitrary command execution as root.

CVE-2026-33824 - Microsoft Windows IKE Extension

Real-world exploitation of CVE-2026-33824 has been documented, but no authoritative, fully functional researcher-published PoC has been established in the Microsoft or NVD references reviewed.

Publicly Available	Public prototype exploit code exists, but the identified repository explicitly states that it is not fully functional.
Description	The public repository contains prototype exploit code targeting the double-free condition in the Windows IKE Extension, including heap-grooming and ROP-related components, but its author states that the project is not fully functional. Separately, Unit 42 documented active exploitation and reverse-shell attempts against Windows IKE VPN endpoints.

Reproducibility

CVE-2026-65400 - Apple macOS Screen Sharing

CVE-2026-65400 is reproducible using publicly available PoC material, with NCSC-NL confirming that public PoC code exists. Reproduction requires an unpatched macOS system with Screen Sharing enabled and network-reachable, commonly over TCP/5900. The exploit targets the Screen Sharing authentication process to bypass valid credential requirements. Apple's advisory describes the flaw as an authentication state-management issue but does not disclose the complete protocol-level mechanics.

CVE-2026-55040 - Microsoft SharePoint

CVE-2026-55040 can be reproduced using the public PoC and technical research published by Rapid7. Testing requires a vulnerable, unpatched SharePoint Server instance that is reachable over the network. The published exploit obtains the information required to construct forged JWT authentication tokens and uses them to impersonate SharePoint users, demonstrating the authentication bypass against affected SharePoint environments.

CVE-2026-59310 - VMware vCenter

CVE-2026-59310 can be reproduced from the technical exploitation details published by Atredis Partners. Reproduction requires network access to a vulnerable vCenter appliance, including the affected Syslog service and the components involved in the subsequent exploitation path. At a high level, crafted Syslog input is used to place attacker-controlled content on the appliance, which can then be processed through the vulnerable service chain to achieve arbitrary command execution as root.

CVE-2026-33824 - Microsoft Windows IKE Extension

CVE-2026-33824 is demonstrably exploitable, with Unit 42 documenting attacks against real Windows IKE VPN endpoints. Public prototype exploit material also exists, but the identified implementation is explicitly described as not fully functional. Reproduction requires a vulnerable Windows system with the IKE/IPsec service reachable over the network and involves triggering the double-free condition during IKE processing; however, a complete and reliably reproducible public exploit has not been established from the reviewed authoritative sources.

Time-to-Exploit Analysis

CVE-2026-65400 - Apple macOS Screen Sharing

Metric	Assessment
Time from Disclosure to PoC Release	Within 6 days. Apple disclosed and patched the vulnerability on August 6, 2026, and NCSC-NL confirmed public PoC availability by August 12, 2026.
Time from Disclosure to Active Exploitation	Within 6 days based on public confirmation. NCSC-NL reported known active exploitation by August 12, 2026; the precise first-exploitation date is not publicly established.
Time from Patch to Exploit in Wild	Within 6 days based on public confirmation. Apple released fixes on August 6, while NCSC-NL confirmed active exploitation by August 12. CISA subsequently added the CVE to KEV on August 18.
Risk Interpretation	Immediate (0-7 days). Public PoC availability and confirmed exploitation emerged within days of disclosure, making unpatched Macs with network-reachable Screen Sharing a high-priority remediation target.

CVE-2026-55040 - Microsoft SharePoint

Metric	Assessment
Time from Disclosure to PoC Release	Approximately 1 month. Microsoft disclosed and patched the vulnerability on July 14, 2026; Rapid7 publicly released its technical analysis and PoC in August 2026.
Time from Disclosure to Active Exploitation	Within 35 days based on CISA confirmation. The vulnerability was disclosed on July 14 and added to the CISA KEV Catalog on August 18, 2026; the precise first-exploitation date is not publicly established.
Time from Patch to Exploit in Wild	Within 35 days based on public confirmation. Microsoft's fix was available from July 14, while CISA confirmed exploitation through the August 18 KEV addition.
Risk Interpretation	High. A functional public exploit is available and real-world exploitation is confirmed, significantly increasing the risk to unpatched and network-accessible SharePoint deployments.

CVE-2026-59310 - VMware vCenter

Metric	Assessment
Time from Disclosure to PoC Release	Technical exploitation details were publicly released around the disclosure period by Atredis Partners. The research documents the exploitation path leading from crafted Syslog input to arbitrary command execution.
Time from Disclosure to Active Exploitation	Within 20 days based on CISA confirmation. Broadcom disclosed the vulnerability on July 29, 2026, and CISA added it to KEV on August 18; the exact first-exploitation date is not publicly established.
Time from Patch to Exploit in Wild	Within 20 days based on public confirmation. Fixed builds became available with Broadcom's July 29 advisory, while CISA confirmed exploitation through its August 18 KEV addition.
Risk Interpretation	Immediate. Public technical exploitation details, confirmed real-world exploitation, unauthenticated network access, and the potential for arbitrary code execution on critical vCenter infrastructure make unpatched systems a high-priority target.

CVE-2026-33824 - Microsoft Windows IKE Extension

Metric	Assessment
Time from Disclosure to PoC Release	No authoritative date for a fully functional public PoC was established. Public prototype exploit material exists, but the identified implementation states that it is not fully functional.
Time from Disclosure to Active Exploitation	Within 126 days based on CISA confirmation. Microsoft disclosed the vulnerability on April 14, 2026, and CISA added it to KEV on August 18; Unit 42 separately documented operational exploitation activity.
Time from Patch to Exploit in Wild	Within 126 days based on public confirmation. Microsoft released the fix on April 14, 2026, approximately four months before the vulnerability was added to CISA KEV.
Risk Interpretation	High despite the long patch window. The vulnerability had been patched for approximately four months before confirmed exploitation surfaced, demonstrating that older unpatched vulnerabilities can rapidly become operational threats once attackers adopt them.

Active Exploitation & Threat Actors

CVE-2026-65400 - Apple macOS Screen Sharing

Exploitation Observed in the Wild: Yes - confirmed.

Associated Threat Actors: No named threat actor, APT group, ransomware operator, or initial access broker has been publicly attributed to the exploitation.

Campaign Details: NCSC-NL documented exploitation against multiple macOS systems where Screen Sharing on TCP/5900 was exposed to the internet. Following compromise, attackers obtained root-level access and deployed a Monero cryptocurrency miner.

Attack Techniques Observed: Exploitation of internet-exposed Screen Sharing for unauthorized access, followed by cryptocurrency-miner deployment and persistence activity.

The primary concern is the combination of an unauthenticated network-accessible vulnerability and observed post-exploitation activity. Systems exposing Screen Sharing to untrusted networks are particularly at risk because successful exploitation can provide attackers with an initial foothold from which additional payloads can be deployed.

CVE-2026-55040 - Microsoft SharePoint

Exploitation Observed in the Wild: Yes - confirmed by CISA KEV.

Associated Threat Actors: No specific threat actor, APT group, ransomware operator, or initial access broker has been authoritatively attributed to the observed exploitation.

Campaign Details: CISA confirms active exploitation through its KEV listing, but the authoritative sources reviewed do not describe a specific exploitation campaign, targeted organization set, or geographic focus.

Attack Techniques Observed: The vulnerability enables authentication bypass through insufficient validation of SharePoint authentication tokens. Public research demonstrates user impersonation, but the precise techniques used in confirmed in-the-wild attacks have not been publicly detailed.

The principal risk comes from the availability of working public exploit material combined with confirmed real-world exploitation. Network-accessible, unpatched SharePoint servers therefore present an attractive target even though the actors responsible for current exploitation have not been publicly identified.

CVE-2026-59310 - VMware vCenter

Exploitation Observed in the Wild: Yes - confirmed.

Associated Threat Actors: The exploitation campaign has been attributed with moderate confidence to a suspected China-nexus APT actor.

Campaign Details: The campaign has compromised 361 unique victim IP addresses across 47 countries, with Germany, the United States, Turkey, Iran, and France among the most affected. The scale indicates broad exploitation of vulnerable vCenter infrastructure rather than isolated testing.

Attack Techniques Observed: Following exploitation, attackers deployed a reverse SSH backdoor to maintain remote access. In at least one documented intrusion, the compromise progressed to deployment of Babuk-derived ransomware against ESXi hosts.

The activity shows that CVE-2026-59310 is being used as more than an initial code-execution primitive. Compromise of vCenter can give attackers privileged access to the virtualization management layer, after which persistence can be established and activity can extend to ESXi systems managed through the environment.

CVE-2026-33824 - Microsoft Windows IKE Extension

Exploitation Observed in the Wild: Yes - confirmed.

Associated Threat Actors: Unit 42 linked observed exploitation activity to a Chinese-speaking threat actor. The activity has not been established as belonging to a specifically named APT, ransomware group, or initial access broker.

Campaign Details: Unit 42 documented exploitation attempts against Windows IKE VPN endpoints as part of a broader intrusion campaign. The researchers observed activity targeting three IKE VPN endpoints and associated reverse-shell callbacks following exploitation attempts.

Attack Techniques Observed: Attackers targeted the Windows IKE service remotely and attempted to use successful exploitation to establish reverse-shell access to affected systems.

CVE-2026-33824 therefore has stronger public threat-actor context than the other vulnerabilities in this group. The combination of CISA-confirmed exploitation and Unit 42's observations shows that the vulnerability has moved from a patched memory-corruption flaw into an operational technique being used against externally reachable VPN infrastructure.

Vulnerability Timeline

CVE-2026-65400 - Apple macOS Screen Sharing

Event	Date
Vulnerability Discovered	Not publicly disclosed
Vendor Notified	Not publicly disclosed
Public Disclosure	August 6, 2026
PoC Released	Public PoC confirmed available by NCSC-NL by August 12, 2026; exact initial publication date not established
Exploitation in Wild Began	Confirmed by NCSC-NL by August 12, 2026; precise first-observed exploitation date not publicly established
Patch Released	August 6, 2026 - macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9
CISA KEV Addition	August 18, 2026

CVE-2026-55040 - Microsoft SharePoint

Event	Date
Vulnerability Discovered	Not publicly disclosed
Vendor Notified	Not publicly disclosed
Public Disclosure	July 14, 2026
PoC Released	Public PoC released by Stephen Fewer / Rapid7 in August 2026
Exploitation in Wild Began	Confirmed by CISA by August 18, 2026; precise first-observed date not publicly established
Patch Released	July 14, 2026 - Microsoft July 2026 SharePoint security updates
CISA KEV Addition	August 18, 2026

CVE-2026-59310 - VMware vCenter

Event	Date
Vulnerability Discovered	Not publicly disclosed
Vendor Notified	Privately reported to Broadcom; specific date not publicly disclosed
Public Disclosure	July 29, 2026
Technical Exploit Details Published	Publicly documented by Atredis Partners; exact publication date should be taken from the original advisory/repository record
Exploitation in Wild Began	Confirmed by CISA by August 18, 2026; precise first-observed date not publicly established
Patch Released	July 29, 2026 - initial fixed builds; Broadcom subsequently updated the advisory with additional builds
CISA KEV Addition	August 18, 2026

CVE-2026-33824 - Microsoft Windows IKE Extension

Event	Date
Vulnerability Discovered	Not publicly disclosed
Vendor Notified	Not publicly disclosed
Public Disclosure	April 14, 2026
PoC Released	Public prototype exploit material exists; exact initial publication date not established and the identified implementation is not fully functional
Exploitation in Wild Began	Operational exploitation documented by Unit 42 and confirmed by CISA by August 18, 2026; precise first-exploitation date not publicly established
Patch Released	April 14, 2026 - Microsoft April 2026 security updates
CISA KEV Addition	August 18, 2026

Root Cause Analysis

CVE-2026-65400 - Apple macOS Screen Sharing

CVE-2026-65400 is an improper authentication vulnerability (CWE-287) in macOS Screen Sharing. The flaw originates in how the Screen Sharing component manages authentication state during a remote connection. Under the vulnerable condition, the service can transition into an authenticated state without successfully validating valid user credentials.

Apple addressed the vulnerability by improving state management in Screen Sharing. Successful exploitation allows a network-connected attacker to bypass the expected authentication boundary and gain Screen Sharing access without valid credentials. Apple's advisory confirms the authentication and state-management failure but does not publicly document the complete protocol-level root cause or the exact malformed authentication sequence responsible for triggering it.

CVE-2026-55040 - Microsoft SharePoint

CVE-2026-55040 is a weak authentication vulnerability (CWE-1390) in Microsoft SharePoint Server. The issue affects validation of actor tokens used by SharePoint for server-to-server and workflow authentication. Under vulnerable conditions, SharePoint does not sufficiently validate authentication information contained in these tokens before accepting the represented identity.

This validation weakness allows an unauthenticated network attacker to construct authentication material that SharePoint accepts as belonging to another user. Public Rapid7 research demonstrates that forged JWT authentication tokens can be used to impersonate SharePoint users, including privileged accounts. The fundamental security failure is therefore insufficient validation at the authentication boundary rather than exploitation of a memory-corruption condition.

CVE-2026-59310 - VMware vCenter

CVE-2026-59310 is a path traversal vulnerability (CWE-22) affecting the Syslog server in VMware vCenter. The vulnerable service does not sufficiently restrict attacker-controlled path information when processing Syslog input, allowing a network-connected attacker to influence where supplied content is written on the vCenter appliance.

Atredis Partners' technical analysis shows how this file-placement primitive can be combined with subsequent processing on the appliance to achieve arbitrary command execution. Attacker-controlled content can ultimately reach a location that is consumed by a privileged shell process, converting the initial path-handling weakness into code execution as root. The root cause is therefore insufficient restriction of filesystem paths supplied through the Syslog processing path.

CVE-2026-33824 - Microsoft Windows IKE Extension

CVE-2026-33824 is a double-free vulnerability (CWE-415) in the Windows Internet Key Exchange (IKE) Extension. The flaw occurs when memory associated with IKE processing can be released more than once during handling of network-supplied protocol data, leaving the service's memory-management state inconsistent.

An unauthenticated remote attacker can trigger the vulnerable processing path by sending specially crafted network traffic to an affected Windows system running the reachable IKE service. Releasing the same memory allocation multiple times can corrupt process memory and create conditions that can be leveraged for remote code execution. Microsoft confirms the double-free classification and remote-code-execution impact, although the Security Update Guide does not publicly document the complete vulnerable IKE state transition or internal memory layout required for exploitation.

Impact

CVE-2026-65400 - Apple macOS Screen Sharing

CVE-2026-65400 breaks the authentication boundary in macOS Screen Sharing. A remote client can reach a state in which the service accepts the session without successful credential validation, giving an attacker unauthorized interactive access to the Mac. In observed attacks, that foothold was followed by elevated access, persistence, and deployment of a Monero miner, showing that the vulnerability can serve as the entry point for a broader host compromise.

CVE-2026-55040 - Microsoft SharePoint

The SharePoint flaw allows an unauthenticated attacker to abuse weaknesses in actor-token validation and impersonate another SharePoint identity. Because authorization decisions are then made using the impersonated account's privileges, compromise can expose SharePoint data and administrative functions available to that identity. The impact is therefore an application-level authentication and identity-boundary bypass rather than direct memory corruption.

CVE-2026-59310 - VMware vCenter

The vulnerable Syslog path handling can be turned into attacker-controlled file placement on the vCenter appliance and, through subsequent privileged processing, arbitrary command execution. Since vCenter sits in the virtualization management plane, code execution there can give an attacker a highly privileged foothold from which virtual infrastructure, credentials, and connected management functions may be exposed.

CVE-2026-33824 - Microsoft Windows IKE Extension

The IKE Extension flaw is a remotely reachable double-free condition. Releasing the same memory region more than once can corrupt the service's memory-management state and create a path to attacker-controlled code execution. Because exploitation can be triggered through network-facing IKE/IPsec traffic without prior authentication or user interaction, exposed VPN and IPsec endpoints carry the highest practical risk.

Post-Exploitation Details

CVE-2026-65400 - Apple macOS Screen Sharing

Observed attacks did not stop at Screen Sharing access. Attackers gained elevated control, deployed XMRig 6.26.0 for Monero mining, created persistence through a KeepAlive LaunchDaemon, and added an unauthorized SSH public key. These actions provide both continued access and a second remote-management path even after the original Screen Sharing session ends.

CVE-2026-55040 - Microsoft SharePoint

The immediate post-exploitation capability is identity impersonation inside SharePoint. An attacker who forges a token for a privileged user can operate with that account's SharePoint permissions, which may expose documents, site configuration, and administrative actions. Public reporting has not established a consistent persistence, malware, lateral-movement, or command-and-control sequence for the confirmed exploitation activity.

CVE-2026-59310 - VMware vCenter

Successful exploitation can result in commands executing with highly privileged access on the vCenter appliance. In observed campaign activity, attackers used this foothold to deploy a reverse SSH backdoor for continued access, and at least one compromise progressed to Babuk-derived ransomware on ESXi hosts. This demonstrates a practical path from vCenter code execution to persistence and disruption of the underlying virtualization environment.

CVE-2026-33824 - Microsoft Windows IKE Extension

Observed exploitation has included attempts to establish reverse-shell access after attacking Windows IKE VPN endpoints. A reverse shell converts the initial memory-corruption exploit into an interactive command channel, allowing the attacker to issue commands on the compromised system. Public reporting has not conclusively documented a standard persistence or lateral-movement sequence beyond that stage.

MITRE ATT&CK Mapping

CVE	Tactic	Technique	ID
CVE-2026-65400	Initial Access	External Remote Services - exploitation targets an internet-reachable Screen Sharing service	T1133
CVE-2026-65400	Resource Development / Impact	Resource Hijacking - observed deployment of a Monero cryptocurrency miner	T1496
CVE-2026-65400	Persistence	SSH Authorized Keys - unauthorized SSH public key observed following compromise	T1098.004
CVE-2026-55040	Initial Access	Exploit Public-Facing Application - authentication bypass targets network-accessible SharePoint Server	T1190
CVE-2026-59310	Initial Access	Exploit Public-Facing Application - exploitation targets a network-accessible vCenter service	T1190
CVE-2026-59310	Persistence / Command & Control	Remote Access Software - reverse SSH backdoor used to maintain remote access after compromise	T1219
CVE-2026-59310	Impact	Data Encrypted for Impact - Babuk-derived ransomware observed on ESXi hosts in at least one intrusion	T1486
CVE-2026-33824	Initial Access	Exploit Public-Facing Application - exploitation targets externally reachable Windows IKE/IPsec services	T1190
CVE-2026-33824	Command & Control	Command and Scripting Interpreter - reverse-shell activity was observed following exploitation attempts	T1059

The mappings above are analytical mappings based on publicly documented exploitation behavior; they should not be interpreted as vendor-provided ATT&CK mappings.

Vulnerability Chaining Opportunities

CVE-2026-65400 - Apple macOS Screen Sharing

CVE-2026-65400 can act as the initial-access stage of an attack chain because it bypasses authentication on a remote-control service. The observed sequence is already multi-stage: unauthorized Screen Sharing access is followed by elevated control, persistence through LaunchDaemon and SSH-key changes, and cryptocurrency-miner deployment. No second CVE has been confirmed as necessary for that chain.

CVE-2026-55040 - Microsoft SharePoint

The SharePoint bug is useful as an authentication-bypass stage because a forged actor token can place the attacker inside the application as another user. A privileged impersonated identity could then expose administrative functions or make other reachable weaknesses easier to abuse. No specific secondary CVE has been authoritatively linked to the confirmed in-the-wild exploitation.

CVE-2026-59310 - VMware vCenter

CVE-2026-59310 already bridges two security boundaries: attacker-controlled Syslog input becomes filesystem influence and then privileged command execution. Observed campaign activity shows that this access can then be followed by deployment of a reverse SSH backdoor and, in at least one case, Babuk-derived ransomware on ESXi hosts. CVE-2026-59309, a VMware Directory Service authentication-bypass issue disclosed in the same advisory, affects overlapping vCenter environments, but no confirmed evidence currently shows the two CVEs being chained together.

CVE-2026-33824 - Microsoft Windows IKE Extension

CVE-2026-33824 can provide the remote code-execution stage against an exposed IKE/IPsec endpoint. Once code execution is obtained, observed reverse-shell activity shows how the exploit can transition into interactive control of the host. No additional CVE has been publicly confirmed as part of that exploitation chain.

Detection and Monitoring

CVE-2026-65400 - Apple macOS Screen Sharing

Monitor Macs for externally sourced Screen Sharing connections to TCP/5900 that do not match expected administrative activity. After suspicious Screen Sharing access, look for new root-owned processes, sustained CPU usage, XMRig-related files or processes, unfamiliar LaunchDaemons, and changes to SSH authorized keys. These host-level artifacts are especially important because patching the vulnerability does not remove persistence already created by an attacker.

CVE-2026-55040 - Microsoft SharePoint

Detection should focus on authentication and authorization behavior rather than a single payload signature. Correlate IIS, reverse-proxy, and SharePoint logs for unusual token-based authentication, unexpected user impersonation patterns, and privileged actions that do not align with the legitimate account's normal activity. Sudden administrative behavior from service or low-activity accounts should receive additional scrutiny.

CVE-2026-59310 - VMware vCenter

Monitor traffic directed at the vCenter Syslog service together with filesystem and process telemetry on the appliance. Unexpected path-like values, unusual file creation by Syslog-related components, or shell/process execution that follows Syslog activity can indicate exploitation. Defenders should also watch for unexpected reverse SSH activity, unfamiliar persistent remote-access processes, and ransomware-related changes on connected ESXi hosts.

CVE-2026-33824 - Microsoft Windows IKE Extension

Monitor UDP/500 and UDP/4500 for unusual or malformed IKE/IPsec negotiation traffic, particularly from unfamiliar external sources. Repeated IKEEXT crashes or service restarts can indicate failed memory-corruption attempts. Network or endpoint telemetry showing unexpected outbound connections or command-shell activity shortly after suspicious IKE traffic should be investigated for post-exploitation access.

Risk Assessment

Vulnerability	Impact	Exploit Maturity	Overall Risk
CVE-2026-65400	High - authentication bypass against a remote-access service with documented post-exploitation activity	Public PoC and confirmed exploitation	Critical
CVE-2026-55040	High - unauthenticated bypass of SharePoint authentication controls	Functional public PoC and confirmed exploitation	Critical
CVE-2026-59310	Critical - arbitrary code execution on virtualization-management infrastructure	Confirmed exploitation with observed reverse SSH persistence and ransomware activity	Critical
CVE-2026-33824	Critical - unauthenticated remote code execution through a network-facing Windows service	Confirmed exploitation; public prototype exploit material exists	Critical

All four vulnerabilities warrant urgent remediation because exploitation has been confirmed in the wild. CVE-2026-65400 is particularly concerning on Macs exposing Screen Sharing to untrusted networks, while CVE-2026-55040 places internet-facing SharePoint deployments at risk of authentication bypass. CVE-2026-59310 carries substantial infrastructure impact because successful exploitation compromises the vCenter management plane, and CVE-2026-33824 exposes network-facing Windows IKE/IPsec systems to unauthenticated remote code execution.

Patch and Mitigation

CVE-2026-65400 - Apple macOS Screen Sharing

Apple fixed the Screen Sharing authentication-state flaw in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. Systems should be upgraded to these or later supported releases. Until patching is complete, remove direct internet exposure of TCP/5900 and disable Screen Sharing on systems that do not require it. Because post-exploitation persistence has been observed, affected hosts should also be checked for unauthorized LaunchDaemons, SSH keys, and mining processes.

CVE-2026-55040 - Microsoft SharePoint

Microsoft addressed the actor-token validation weakness in the July 2026 SharePoint security updates. Administrators should update SharePoint Server Subscription Edition to 16.0.19725.20434, SharePoint Server 2019 to 16.0.10417.20175, and SharePoint Enterprise Server 2016 to 16.0.5561.1001 or later. Every server in a farm should be verified because mixed patch levels can leave vulnerable authentication paths available.

CVE-2026-59310 - VMware vCenter

Broadcom released fixed builds including 9.1.0.0300, 9.0.2.0100, and 8.0 U3k. No vendor workaround is available, so patching is the primary remediation. Network access to vCenter and its supporting services should be limited to trusted administration segments. Systems that were exposed before patching should also be checked for unexpected reverse SSH access, persistence artifacts, and signs of ransomware activity on connected ESXi hosts.

CVE-2026-33824 - Microsoft Windows IKE Extension

Microsoft fixed the IKE double-free issue through the April 2026 Windows security updates. Apply the applicable April 2026 or later cumulative update and verify the resulting OS build against Microsoft's fixed-version matrix. VPN gateways, edge systems, and other hosts exposing IKE/IPsec to untrusted networks should be prioritized because the vulnerable code path is reachable remotely without authentication.

Remediation Recommendations

Immediate actions should prioritize patching all four vulnerabilities because each has confirmed exploitation in the wild. Inventory systems exposing Screen Sharing, SharePoint, vCenter, or Windows IKE/IPsec services and verify their exact installed builds against the vendor-fixed versions. Internet-facing management and remote-access services should be addressed first.

Near-term actions should reduce unnecessary network exposure and include compromise checks on systems that were vulnerable before patching. For macOS, review LaunchDaemons, SSH keys, and mining activity; for SharePoint, review unusual token-based authentication and privileged actions; for vCenter, inspect Syslog-related file and process activity, reverse SSH persistence, and ESXi ransomware indicators; and for Windows IKE endpoints, review service crashes, suspicious IKE traffic, and unexpected reverse-shell-like connections.

Long-term improvements should combine KEV-driven patch prioritization with accurate asset inventories and network segmentation for management services. The delay between some original patch dates and later confirmed exploitation shows why an older CVE should be re-escalated immediately when threat intelligence changes, even if the vulnerability has already been available in patch catalogs for months.

Instantly Fix Risks with Saner Patch Management

Saner Patch Management is a continuous, automated, and integrated patch management solution that helps organizations rapidly remediate vulnerabilities actively exploited in the wild. It supports Windows, Linux, macOS, and more than 550 third-party applications, enabling timely deployment of security updates across enterprise environments.

The platform also provides safe patch testing environments, automated deployment workflows, compliance reporting, and patch rollback capabilities to minimize operational risk while ensuring critical vulnerabilities are addressed without delay.

Experience the fastest and most accurate patching software here.