Breaking: Four Actively Exploited CVEs Added to CISA KEV — Three CVSS 9.0+ — 19 Aug 2026

CISA Adds Four Actively Exploited Vulnerabilities to KEV — Three CVSS 9.0+

CISA has added four vulnerabilities to its Known Exploited Vulnerabilities catalog, all with confirmed active exploitation. Three carry CVSS scores of 9.0 or above. The additions, made August 18, come with remediation deadlines as short as three days under BOD 26-04.

macOS Screen Sharing Authentication Bypass (CVE-2026-65400, CVSS 9.8)

The most urgent addition. A pre-authentication bypass in macOS Screen Sharing allows remote attackers on the network to authenticate without valid credentials. The Dutch National Cyber Security Centre (NCSC-NL) confirmed on August 12 that the flaw is under active exploitation — attackers are compromising internet-exposed Macs (specifically those with port 5900 open) and deploying Monero cryptocurrency miners after gaining root access. Apple patched the vulnerability last week for macOS Tahoe, Sequoia, and Sonoma. If you run macOS servers or developer workstations exposed to the internet, this is not theoretical — cryptomining payloads are already deployed in the wild. KEV remediation deadline: August 21.

VMware vCenter Directory Traversal RCE (CVE-2026-59310, CVSS 9.8)

A directory traversal vulnerability in VMware vCenter's Syslog service component enables remote code execution by any attacker with network access. Broadcom disclosed the flaw on July 29; by August 3 — five days later — a suspected China-nexus APT was already exploiting it at scale. The QUIRSO research team has traced the campaign to 361 victim IP addresses across 47 countries, with Germany, the US, Turkey, Iran, and France accounting for over half of confirmed victims. In at least one case, Babuk-derived ransomware was deployed as a forensic smokescreen after the attackers established persistent backdoor access via reverse SSH tunnels. This is datacentre infrastructure under active nation-state attack. KEV remediation deadline: August 21.

Microsoft SharePoint Authentication Bypass (CVE-2026-55040, CVSS 9.1)

A weak authentication vulnerability in SharePoint Server's JWT validation pipeline allows unauthenticated remote attackers to bypass security controls and impersonate privileged accounts. Microsoft patched it in July's Patch Tuesday, but Rapid7 published a proof-of-concept on August 12 — and active exploitation followed within days. On-premises SharePoint Server Subscription Edition and 2019/2016 are affected. If you run SharePoint and haven't applied July's patches, assume compromise. KEV remediation deadline: August 21.

Microsoft IKE Service Extensions Double Free (CVE-2026-33824)

A double-free vulnerability in Microsoft's Internet Key Exchange service extensions could enable remote code execution. CISA's KEV listing confirms active exploitation. This was patched in August Patch Tuesday alongside the afd.sys privilege escalation (CVE-2026-68820, also KEV-listed and exploited by Lazarus Group). KEV remediation deadline: August 21.

So What / Action

Four actively exploited vulnerabilities added to KEV in a single day, three of them CVSS 9.0+ — and all with an August 21 remediation deadline. That is 72 hours from now. For CISOs: run immediate exposure assessments against all four CVEs. Prioritise by attack surface — internet-facing vCenter and SharePoint instances first, followed by macOS endpoints with Screen Sharing enabled and remote access. For vCenter specifically: if you cannot patch by August 21, audit for unauthorised reverse SSH connections and backdoor accounts, because the exploitation campaign is mature and widespread. For macOS: verify Screen Sharing is disabled on internet-exposed hosts, or confirm the Apple patch is applied. The three-day BOD 26-04 window is not aspirational — it reflects how fast these are being exploited in the wild.