XHack
Author
Table of Contents
13
Read this in 30 seconds: On August 18, 2026, CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active attacks: a wormable, unauthenticated Windows IKE flaw (CVSS 9.8), a SharePoint authentication bypass being hit within hours of a public PoC (CVSS 9.1), a VMware vCenter path traversal already compromising hundreds of servers across 47 countries (CVSS 9.8), and a macOS Screen Sharing auth bypass being used to install cryptominers (CVSS 9.8). Federal agencies have until August 21 to patch. Everyone else should not wait that long. Here is what each one actually does, and what to check today.
Four critical vulnerabilities, three of them CVSS 9.8, all confirmed under active attack, added to CISA’s Known Exploited Vulnerabilities catalog in a single batch. That is not a normal week, even by 2026 standards.
The pattern across all four is the same one defenders keep losing to: a patch ships, a technical writeup or proof-of-concept follows within days, and attackers weaponize it before most organizations finish their change-control paperwork. Here is exactly what CISA added, and why each one deserves attention today, not next sprint.
| CVE | Product | CVSS | The Flaw |
|---|---|---|---|
| CVE-2026-33824 | Windows IKE Service Extensions | 9.8 | Unauthenticated, wormable RCE |
| CVE-2026-55040 | SharePoint (on-prem) | 9.1 | JWT auth bypass, no credentials needed |
| CVE-2026-59310 | VMware vCenter | 9.8 | Unauthenticated path traversal to RCE |
| CVE-2026-65400 | macOS Screen Sharing | 9.8 | Auth bypass, root access |
Three of the four require no authentication at all. That is the throughline: an attacker with network access, not stolen credentials, is enough.
This one is the most dangerous by design. It’s a double-free bug in how Windows reassembles IKEv2 packets, the protocol behind VPN key exchange. An attacker sends specially crafted UDP packets to port 500 or 4500, no login, no user interaction, and triggers memory corruption that leads to remote code execution. Because it needs nothing but network reachability, security researchers have flagged it as wormable. Microsoft patched it back in April 2026; the exploitation CISA confirmed this month means a lot of systems still haven’t applied it.
This is a textbook case of an old mistake resurfacing. SharePoint’s token validation accepted `alg: none` JWTs, a bypass technique documented over a decade ago and formally deprecated by the IETF in 2020. An attacker forges a token referencing SharePoint’s own certificate, and the server accepts it without ever checking the signature, granting access as a site user or full administrator. Microsoft patched it in July. Rapid7 published a technical breakdown on August 11, and attackers were exploiting unpatched servers within hours. This is the fifth SharePoint vulnerability actively exploited in 2026 alone.
Broadcom disclosed this directory traversal flaw in vCenter’s Syslog Server on July 29. Five days later, on August 3, a suspected advanced persistent threat actor was already exploiting it. By August 7, BleepingComputer reported 361 compromised IP addresses across 47 countries, concentrated in Germany, the US, Turkey, Iran, and France. Post-exploitation, attackers deploy the open-source `reverse_ssh` framework to establish persistent, firewall-evading command and control. If you run vCenter 8.0, 9.0, or 9.1 and haven’t updated, assume you’re a target, not a maybe.
An authentication flaw in macOS Screen Sharing, caused by insufficient session-state management, lets an attacker on the network connect without any valid credentials at all. Apple patched it on August 6 across Tahoe, Sequoia, and Sonoma. The Dutch National Cyber Security Centre has since documented real-world exploitation, with attackers gaining root access on internet-exposed Macs, port 5900, and installing Monero cryptominers. Root access for a cryptominer today is root access for something worse tomorrow.
Look at the timelines. SharePoint: hours from public technical writeup to active exploitation. vCenter: five days from patch to APT activity, hundreds of servers, dozens of countries, by day nine. This is the same compression AI-assisted exploit development has been driving across the industry all year, and CISA’s Known Exploited Vulnerabilities catalog exists specifically because “we’ll patch it next quarter” no longer holds up against that speed.
This is exactly the gap XHack AI’s continuous, autonomous testing model is built for. Instead of waiting for a quarterly pentest to discover you’re running an unpatched vCenter instance or an exposed SharePoint server, the autonomous agent scans continuously and flags exploitable, KEV-listed conditions as they appear, with human review before anything lands in a report. XHack does not store your user data either; scan results and session data stay on your own infrastructure, and you control what’s kept.
Plans start at $20 a month. If you want a straight answer on whether continuous monitoring would have caught one of these four before CISA did, book a free consultation.
It’s a running list CISA maintains of vulnerabilities with confirmed real-world exploitation, not just theoretical risk. Federal civilian agencies are legally required to patch KEV-listed flaws by CISA’s deadline; everyone else should treat the list as a priority signal, since these are the bugs attackers are actually using today.
Yes. CISA’s remediation deadlines are binding only for federal agencies, but the vulnerabilities are being exploited against everyone, as the vCenter campaign’s 361 compromised servers across 47 countries makes clear. Attackers don’t check who’s regulated before they scan.
Increasingly, in hours to days, not weeks. The SharePoint flaw was exploited within hours of a public technical writeup; vCenter within five days of patch release. Build your patch cadence around that reality, not the old assumption that you have a comfortable window.
Four critical, mostly unauthenticated vulnerabilities, all under active attack, all added to CISA’s Known Exploited Vulnerabilities catalog in one day. Patch Windows, SharePoint, vCenter, and macOS Screen Sharing now, not after the next incident report makes the decision for you.
Related articles
Read this in 30 seconds: A phishing toolkit called iAuthFlow V2, selling for roughly $10,000 on Russian-language cybercr...
Read this in 30 seconds: This Rust supply chain attack happened on August 20, 2026, when attackers compromised the maint...
