US Warns of Critical Vulnerabilities Exploited in Microsoft, VMware, and Apple Products

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning to federal agencies to patch four critical vulnerabilities in popular software products. The flaws, which have been exploited in the wild, affect Microsoft, VMware, and Apple products.

CISA has added two Microsoft flaws, CVE-2026-33824 and CVE-2026-55040, to its Known Exploited Vulnerabilities (KEV) catalog. The first vulnerability, a double free issue in the Windows Internet Key Exchange (IKE) Service Extension, allows remote attackers to execute arbitrary code via specially crafted packets. The second flaw, a weak authentication weakness in SharePoint, was patched on Microsoft's July 2026 Patch Tuesday.

Threat actors have been exploiting these vulnerabilities since April and July, respectively. CISA is urging federal agencies to patch all four security defects by August 21, in line with BOD 26-04 recommendations.