Ethical Hacking News
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, which includes vulnerabilities in Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE. These vulnerabilities pose significant security risks, and organizations are urged to address them promptly to protect themselves against potential attacks. In this article, we delve into the details of these vulnerabilities and the importance of cybersecurity in the face of emerging threats.
Four new vulnerabilities have been added to the Known Exploited Vulnerabilities (KEV) catalog, including CVE-2026-33824, CVE-2026-55040, CVE-2026-59310, and CVE-2026-65400. CVE-2026-33824 is a Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability that allows remote attackers to execute code on affected systems. CVE-2026-55040 is a critical SharePoint authentication bypass that enables unauthenticated attackers to forge tokens and impersonate any SharePoint user. CVE-2026-59310 is a Path Traversal Vulnerability in VMware vCenter's Syslog server that allows an attacker with network access to execute arbitrary code. CVE-2026-65400 is an Improper Authentication Vulnerability in macOS's built-in Screen Sharing feature that enables attackers on the network to authenticate to Screen Sharing without valid credentials. Federal agencies and private organizations are ordered to fix the flaws by August 21, 2026, and experts recommend proactive measures to address these vulnerabilities.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, which has sparked concerns among cybersecurity experts and organizations alike. The added vulnerabilities include CVE-2026-33824, CVE-2026-55040, CVE-2026-59310, and CVE-2026-65400, which affect various software systems, including Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE.
CVE-2026-33824, a Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability, allows remote attackers to execute code on affected systems, which can lead to significant security risks. Systems with IKE enabled are at risk, and blocking UDP ports 500 and 4500 can reduce exposure from external threats. However, internal attackers may still exploit it for lateral movement, making rapid patching essential.
CVE-2026-55040, a critical SharePoint authentication bypass, enables unauthenticated attackers to forge tokens and impersonate any SharePoint user, including administrators. This vulnerability is particularly concerning as it can be exploited using Rapid7's POC (Proof of Concept) code.
CVE-2026-59310, a Path Traversal Vulnerability in VMware vCenter's Syslog server, allows an attacker with network access to execute arbitrary code. The severity of this issue has been rated as Critical, with a maximum CVSSv3 base score of 9.8.
Finally, CVE-2026-65400, an Improper Authentication Vulnerability in macOS's built-in Screen Sharing feature, enables attackers on the network to authenticate to Screen Sharing without valid credentials. This vulnerability was recently confirmed to be actively exploited by the Dutch National Cyber Security Centre.
The addition of these vulnerabilities to the KEV catalog highlights the growing concern for cybersecurity in the United States. It emphasizes the importance of organizations and individuals taking proactive measures to address these vulnerabilities and protect themselves against potential attacks.
In response to these added vulnerabilities, CISA has ordered federal agencies to fix the flaws by August 21, 2026. Experts also recommend that private organizations review the catalog and address the vulnerabilities in their infrastructure.
The recent additions to the KEV catalog underscore the need for continued vigilance and proactive measures in the fight against cyber threats. As the threat landscape continues to evolve, it is essential for individuals and organizations to stay informed and take steps to protect themselves against emerging vulnerabilities.
Related Information:
https://www.ethicalhackingnews.com/articles/US-CISA-Adds-Vulnerabilities-to-Known-Exploited-Vulnerabilities-Catalog-A-Growing-Concern-for-Cybersecurity-ehn.shtml
https://securityaffairs.com/197490/hacking/u-s-cisa-adds-apple-macos-microsoft-sharepoint-broadcom-vmware-vcenter-and-microsoft-ike-flaws-to-its-known-exploited-vulnerabilities-catalog.html
https://windowsforum.com/security-alerts.84/cve-2026-33824-cisa-flags-windows-ike-rce-as-exploited.443096/
https://nvd.nist.gov/vuln/detail/CVE-2026-33824
https://www.cvedetails.com/cve/CVE-2026-33824/
https://nvd.nist.gov/vuln/detail/CVE-2026-55040
https://www.cvedetails.com/cve/CVE-2026-55040/
https://nvd.nist.gov/vuln/detail/CVE-2026-59310
https://www.cvedetails.com/cve/CVE-2026-59310/
https://nvd.nist.gov/vuln/detail/CVE-2026-65400
https://www.cvedetails.com/cve/CVE-2026-65400/
Published: Wed Aug 19 03:20:48 2026 by llama3.2 3B Q4_K_M
