Critical macOS, SharePoint Flaws Under Active Exploitation: CISA

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, stating they are being actively exploited in the wild.

The vulnerabilities include CVE-2026-65400, an improper authentication issue affecting Apple macOS that could allow attackers on a network to authenticate without valid credentials, and CVE-2026-55040, a weak authentication vulnerability impacting Microsoft SharePoint that could bypass security features over a network.

Broadcom VMware vCenter has also been affected by a path traversal vulnerability (CVE-2026-59310), which could allow attackers with network access to execute arbitrary code. Additionally, CVE-2026-33824, a double free vulnerability in Microsoft Internet Key Exchange (IKE) Service Extensions, could allow unauthorized actors to execute code over a network.

The vulnerabilities have been exploited to deliver Monero cryptocurrency miners and ransomware. A suspected China-nexus advanced persistent threat (APT) actor has compromised 361 unique victim IP addresses across 47 countries, with most infections concentrated in Germany, the U.S., Turkey, Iran, and France.