The US Cybersecurity and Infrastructure Security Agency (CISA) has warned of four critical vulnerabilities actively exploited in Microsoft, VMware, and Apple products. The Microsoft Windows IKE Service Extension vulnerability (CVE-2026-33824, CVSS 9.8) is a double free flaw allowing remote unauthenticated code execution via crafted packets, patched in April 2026. The SharePoint vulnerability (CVE-2026-55040, CVSS 9.1) is a weak authentication bypass fixed in July 2026, with exploitation observed after a proof-of-concept release. VMware vCenter's vulnerability (CVE-2026-59310, CVSS 9.8) was patched on July 29, 2026, with exploitation starting August 3 to deploy SSH reverse shells. The macOS Screen Sharing flaw (CVE-2026-65400, CVSS 7.5) allows authentication bypass and root access, patched August 6, with in-the-wild exploitation deploying Monero miners shortly after. CISA added these to its Known Exploited Vulnerabilities catalog and urges patching by August 21, 2026, per BOD 26-04.

These vulnerabilities allow remote attackers to execute arbitrary code without authentication, bypass authentication mechanisms, and take full control of affected devices. Exploitation has been observed in the wild, including deployment of reverse shells and cryptocurrency mining malware. The impact includes potential full system compromise, unauthorized access, and resource abuse. The high CVSS scores (7.5 to 9.8) reflect severe risk to confidentiality, integrity, and availability of affected systems.

Patches for all four vulnerabilities have been officially released by the respective vendors between April and August 2026. CISA strongly urges immediate application of these patches, especially for federal agencies, by August 21, 2026, in accordance with BOD 26-04. No additional mitigations are specified beyond applying the official fixes. Organizations should verify patch deployment promptly to prevent exploitation.