Full research report
Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
Executive assessment
The headline joins four independently exploitable security flaws rather than documenting one shared attack chain. CISA's 18 August action is strong evidence that each CVE has been exploited, even though the Microsoft advisories still display their older release-time assessments of no exploitation. Vendor records show that all four cross remotely reachable security boundaries and that fixes are available, with Broadcom explicitly stating that no vCenter workaround exists. Detailed claims concerning cryptocurrency mining, China-linked operators, reverse_ssh and Babuk-derived ransomware remain insufficiently corroborated and should guide hunting rather than attribution decisions.
What happened
Between April and July 2026, Microsoft, Apple and Broadcom published fixes for four critical network-reachable vulnerabilities affecting Windows IKE, SharePoint, macOS Screen Sharing and VMware vCenter. On 18 August, CISA added all four to its Known Exploited Vulnerabilities catalogue based on evidence of active exploitation and assigned a 21 August 2026 remediation deadline to applicable federal systems. Reporting published on 19 August associated the separate vulnerabilities with several campaigns, but those detailed malware and attribution claims remain less firmly established than the exploitation itself.
Affected scope
CVE-2026-65400 affects macOS Tahoe, Sequoia and Sonoma before the fixed releases 26.6.1, 15.7.9 and 14.8.9 respectively. CVE-2026-55040 affects Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019 and SharePoint Enterprise Server 2016 before the July security builds. CVE-2026-59310 affects vCenter 9.1.x, 9.0.x, 8.0 and supported 7.0 deployments, including vCenter components supplied through VMware Cloud Foundation, vSphere Foundation and specified telco products. CVE-2026-33824 affects the supported Windows client and server releases listed by Microsoft where IKEv2 is enabled.
Technical assessment
The four vulnerabilities are separate rather than one campaign or exploit chain. They cross distinct security boundaries: macOS Screen Sharing can accept network authentication without valid credentials; SharePoint weak authentication permits an anonymous connection and impersonation; vCenter's Syslog server contains directory traversal that can lead to arbitrary code execution for a network-reachable attacker; and Windows IKE contains a double-free condition reachable through IKEv2 traffic that can result in remote code execution. CISA's catalogue establishes exploitation in the wild, while the public SharePoint proof-of-concept and campaign-specific payload claims are reported rather than independently verified here.
Recommended defensive actions
- Immediately apply macOS Tahoe 26.6.1, Sequoia 15.7.9 or Sonoma 14.8.9, as appropriate, and restrict Screen Sharing to trusted management networks.
- Patch SharePoint Subscription Edition, 2019 and 2016 with the July 2026 security updates, then investigate anonymous connections, unexpected file access and unauthorised data modifications predating the update.
- Upgrade vCenter to the Broadcom-listed fixed release, including 9.1.0.0300, 9.0.2.0100, 8.0 U3k or 8.0 U2f as applicable; contact Broadcom for supported 7.0 deployments because no workaround exists.
- Apply the April 2026 Windows security update corresponding to every affected client and server build where IKEv2 is enabled.
- Block inbound UDP ports 500 and 4500 on systems that do not require IKE, and restrict those ports to known peer addresses where IKE remains necessary.
- Hunt for unexpected Screen Sharing sessions, anonymous SharePoint activity, anomalous vCenter Syslog child processes or file access, and unusual IKE traffic or post-exploitation processes during the pre-patch exposure window.
- Inventory externally and administratively reachable instances of all four products and validate their installed builds against the vendor advisories.
Uncertainties and evidence gaps
- CISA does not publish victim, actor, payload or initial-discovery details for these catalogue additions.
- The reported Monero miner, reverse_ssh, Babuk-derived ransomware and China-linked activity are supported here only by secondary reporting and should not be treated as confirmed attribution.
- A public SharePoint proof of concept is reported, but no independently verified code repository or technical publication was located.
- Microsoft's pages retain their original publication-time assessments of not exploited, whereas CISA later confirmed exploitation; the newer CISA assessment is stronger for current status.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
CISA confirms active exploitation of all four vulnerabilities; public SharePoint proof-of-concept code is reported, but no code location was independently verified.
The investigation first tested whether the headline represented a single campaign or four independent vulnerabilities and found that it combines separate product flaws under one CISA announcement. CISA provides authoritative confirmation of exploitation, while Apple, Microsoft and Broadcom establish the affected components, mechanisms and fixes. The more detailed actor, malware and victim claims could not be independently traced to primary campaign reporting, so they remain credible but unconfirmed secondary claims.
- What event and claims did the supplied story describe?Read the complete 19 August report and separated its four vulnerability claims from its campaign and attribution claims.thehackernews.com ↗
The article grouped four unrelated critical vulnerabilities and attributed different exploitation activity, payloads and actors to each.
why This established that exploitation status required collective confirmation from CISA, while scope, fixes and campaign details required separate verification.
- Does an authoritative source confirm exploitation of every listed CVE?Reviewed CISA's Known Exploited Vulnerabilities catalogue entries and associated notes.cisa.gov ↗
CISA lists all four CVEs as known exploited, added them on 18 August 2026 and set a 21 August federal remediation date.
why This independently confirms in-the-wild exploitation without relying on CVSS, EPSS or the article's wording.
- Which macOS release and security boundary are affected?Read Apple's Tahoe advisory for CVE-2026-65400.support.apple.com ↗
The flaw affects Screen Sharing authentication on macOS Tahoe and is fixed in Tahoe 26.6.1 through improved state management.
why This verifies both the network authentication impact and a concrete fixed release.
- Does the macOS flaw extend to older supported branches?Read Apple's Sequoia and Sonoma advisories, including the Sonoma record shown here.support.apple.com ↗
Apple also fixed CVE-2026-65400 in Sequoia 15.7.9 and Sonoma 14.8.9.
why This broadens the affected scope beyond the current Tahoe branch and prevents incomplete patch advice.
- What does the SharePoint weakness permit, and which editions have fixes?Reviewed Microsoft's CVE-2026-55040 advisory and security-update table.msrc.microsoft.com ↗
An unauthenticated network attacker can bypass authentication, impersonate a user, disclose files and modify data; updates cover Subscription Edition, 2019 and 2016.
why This supports the technical impact and patch scope, while Microsoft's original 'not exploited' field is superseded by CISA's later evidence.
- What vCenter component is vulnerable and which versions are remediated?Reviewed Broadcom VMSA-2026-0006.2 and its response matrix.support.broadcom.com ↗
The directory traversal is in the vCenter Syslog server and can permit arbitrary code execution over the network; fixed releases include 9.1.0.0300, 9.0.2.0100, 8.0 U3k and 8.0 U2f, with no workaround.
why This confirms the vulnerable component, exposure requirement and urgency of applying a vendor patch.
- How is the Windows IKE flaw reached and what temporary controls exist?Reviewed Microsoft's CVE-2026-33824 advisory, FAQ, affected-product table and mitigations.msrc.microsoft.com ↗
The double-free vulnerability is remotely reachable without authentication when IKEv2 is enabled; Microsoft recommends patching and, temporarily, blocking UDP 500/4500 or restricting those ports to known peers.
why This provides a supported defensive control and clarifies that IKE exposure, rather than generic Windows reachability, is the relevant boundary.
- Does CISA's dated announcement explicitly state its evidence basis?Opened CISA's 18 August alert announcing the four additions.cisa.gov ↗
CISA states that all four additions were based on evidence of active exploitation and recommends prioritised risk-based remediation.
why This resolves the central exploitation question and outweighs the vendors' older publication-time exploitability assessments.
Research coverage
All 68 registered source leaves were evaluated for this run: 58 completed, 0 were unavailable, 3 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 54 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| CISA KEVkev | ok1671 records | Primary evidence6 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. Supplied a vendor or government advisory opened and verified during focused research. |
| The Hacker Newsnews | ok9 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| FIRST EPSSepss | ok7807 records | Context4 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| BleepingComputernews | ok12 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | stale fallback0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| Cisco Talosnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok685 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1009 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok12 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1590 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 16 opened outside the registered collection
Vulnerability & exploitation8
Vendor & gov advisories8
Confirms evidence of active exploitation for all four CVEs and requires prioritised remediation.
Records the affected components, weakness classes, 18 August additions and 21 August 2026 federal due date.
Identifies the Screen Sharing authentication flaw and the fixed macOS Tahoe release.
Confirms that macOS Sequoia is affected and fixed in 15.7.9.
Confirms that macOS Sonoma is affected and fixed in 14.8.9.
Documents the unauthenticated impersonation issue and fixes for SharePoint Subscription Edition, 2019 and 2016.
Documents the vCenter Syslog directory-traversal flaw, affected releases, fixed versions and absence of a workaround.
Documents the unauthenticated IKEv2 double-free condition, affected Windows releases, updates and network mitigations.
Analysis & research1
Secondary reporting links the flaws to cryptocurrency mining, suspected China-nexus activity, reverse_ssh and Babuk-derived ransomware, but does not expose its underlying campaign sources.