Four Critical Vulnerabilities Added to CISA KEV With Active Exploitation — Including APT Ransomware Campaign and AI-Driven Hacking
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on August 18, all with confirmed active exploitation in the wild. Three carry CVSS 9.8. Two are linked to Chinese state-nexus actors. One has already resulted in ransomware deployment. The 72-hour patching deadline (August 21) makes this the most consequential KEV update in months.
VMware vCenter Path Traversal — CVE-2026-59310 (CVSS 9.8)
A suspected China-nexus APT is exploiting a directory traversal vulnerability in the vCenter Syslog server to achieve remote code execution. German incident response firm QUIRSO assessed with moderate confidence that the operator works in the UTC+08:00 timezone, based on Chinese-language artifacts in attacker scripts, reuse of Chinese security research, and operational patterns consistent with Chinese-speaking APTs.
The campaign has compromised 361 unique victim IP addresses across 47 countries. Germany (55), the United States (41), Turkey (38), Iran (26), and France (25) top the list. Mainland China is conspicuously absent from the victim list.
The attack chain is elaborate. Initial exploitation via CVE-2026-59310 deploys a WebSocket-based backdoor ("linuxFile") that connects to XOR-obfuscated C2 infrastructure. The actor then creates persistent access through cron jobs disguised as VMware services, drops a JSP web shell, adds rogue administrative accounts to vSphere SSO, extracts vmdir credentials to escalate privileges, and deploys a reverse SSH binary for lateral movement. The campaign culminates in Babuk-derived ransomware on ESXi hosts, encrypting files with the ".babyk" extension.
Separately, CVE-2026-59309 (vCenter authentication bypass) was also exploited on the same compromised appliance as early as August 1, with a rogue admin account created via the vSphere REST API using a User-Agent masquerading as "GoodMoodle-VCFleet/1.0."
Patches were released by Broadcom on July 29. The first exploitation activity appeared five days later.
Microsoft IKE Service Extensions Double Free — CVE-2026-33824 (CVSS 9.8)
A double free vulnerability in the Windows Internet Key Exchange service extensions allows unauthenticated remote code execution over the network via UDP ports 500 or 4500. No authentication required, no user interaction needed.
Palo Alto Networks Unit 42 reports that this flaw is being exploited by a Chinese-speaking threat actor who simultaneously launched an AI-enabled autonomous hacking campaign using DeepSeek. The actor combined manual exploitation of known vulnerabilities with autonomous AI-driven attack flows. This represents one of the first confirmed cases of a threat actor using large language models to autonomously orchestrate vulnerability exploitation in the wild, a worrying escalation in offensive AI use.
Any Windows system running IKE VPN services with ports 500 or 4500 exposed to the internet is at risk.
Apple macOS Screen Sharing Authentication Bypass — CVE-2026-65400 (CVSS 9.8)
A logic flaw in macOS Screen Sharing allows a network-adjacent attacker to authenticate without valid credentials. The Dutch NCSC reports active exploitation against Macs with port 5900 exposed to the internet, with attackers gaining root access and deploying Monero cryptocurrency miners.
Security researcher Alfredo Pesoli of Bynario disclosed the bug, which resides in a legacy VNC authentication path. A separate but related pre-auth vulnerability (discovered by @osxreverser, who deliberately did not report it to Apple) was also patched in macOS 26.6. Calif demonstrated a working exploit for both flaws developed by an AI agent in four hours, underscoring how AI is collapsing the gap between vulnerability disclosure and weaponisation.
Security firm scans identified approximately 40,000 internet-exposed Macs running Screen Sharing, nearly half in the United States, including systems at universities and businesses.
Patch immediately: macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, or macOS Sonoma 14.8.9. If patching is not possible, disable Screen Sharing entirely (General > Sharing > toggle off Screen Sharing).
Microsoft SharePoint Authentication Bypass — CVE-2026-55040 (CVSS 9.1)
A weak authentication flaw in on-premises SharePoint Server allows unauthenticated attackers to bypass security features over the network and impersonate any user, including administrators. The vulnerability targets the JWT validation pipeline in SharePoint Subscription Edition.
Rapid7 published a working proof-of-concept on August 11, and honeypots recorded exploitation attempts within roughly 24 hours. Active exploitation in the wild is now confirmed.
So What / Action
This is a patch-everything-you-can-immediately week. The vCenter campaign is the highest severity: if you run VMware infrastructure and have not applied the July 29 patches, assume compromise and begin incident response, not just patching. Check for the specific IOCs: rogue cron jobs under /etc/cron.d with VMware-themed names, unauthorized accounts ("vcenter_admin", "vcadmin", "adminuser"), the "linuxFile" backdoor process, and reverse SSH binaries. For IKE, any Windows server with VPN services facing the internet should be patched today — this is an unauthenticated RCE with no user interaction. Mac fleets with Screen Sharing enabled, especially those exposed via port 5900, need the emergency Apple updates immediately. SharePoint admins should verify they are running the latest patches and check logs for unauthorised JWT token usage. The AI-driven exploitation of the IKE flaw by a state actor is a signal moment: the gap between disclosure and weaponisation is now measured in hours, not days.