CISA 2026-08-18

CISA KEV — Microsoft Internet Key Exchange (IKE) Service (CVE-2026-33824) +3 more

Machine-generated analysis · WAYSCloud LLM

Four CVEs affecting Microsoft IKE, SharePoint, Broadcom VMware vCenter, and Apple macOS have been added to CISA’s KEV catalog.

Context

The advisory lists CVE-2026-33824 (Microsoft IKE Service Extensions), CVE-2026-55040 (Microsoft SharePoint), CVE-2026-59310 (Broadcom VMware vCenter), and CVE-2026-65400 (Apple macOS). CISA states these vulnerabilities are actively exploited and that agencies should prioritize remediation on publicly exposed assets that grant total control after exploitation. The advisory references BOD 26-04, which requires rapid remediation for such high-risk findings.

Operator considerations

Check: inventory the affected Microsoft, Broadcom, and Apple products and verify current versions.
Isolate: segment any publicly exposed instances of the IKE service, SharePoint sites, vCenter, or macOS systems until they are addressed.
Log: monitor logs for activity associated with the listed CVE identifiers.

From Cybersecurity and Infrastructure Security Agency ↗

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-33824 Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

CVE-2026-55040 Microsoft SharePoint Weak Authentication Vulnerability

CVE-2026-59310 Broadcom VMware vCenter Path Traversal Vulnerability

CVE-2026-65400 Apple macOS Improper Authentication Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation ...

Read the full advisory on CISA →