CISA KEV Alert: Four Actively Exploited CVEs in Microsoft IKE, SharePoint, VMware vCenter, and macOS — Detection and Remediation Guide

On August 18, 2026, CISA added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on confirmed evidence of active exploitation in the wild. This is not a theoretical exercise — every entry in the KEV represents a flaw that threat actors are using right now against real targets. The four additions span a cross-section of the modern enterprise attack surface:

• CVE-2026-33824 — Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
• CVE-2026-55040 — Microsoft SharePoint Weak Authentication Vulnerability
• CVE-2026-59310 — Broadcom VMware vCenter Path Traversal Vulnerability
• CVE-2026-65400 — Apple macOS Improper Authentication Vulnerability

That list should concern every defender reading this. IKE underpins IPsec VPN connectivity on Windows Server. SharePoint remains one of the most-targeted collaboration platforms in enterprise history. vCenter is the crown jewel of virtualized infrastructure — compromise it and an attacker owns every workload underneath it. And macOS endpoints are increasingly the landing zone for initial access in executive and developer populations.

For Federal Civilian Executive Branch (FCEB) agencies, remediation is mandated under Binding Operational Directive (BOD) 26-04, which requires agencies to prioritize security updates based on risk and remediate KEV-listed vulnerabilities within CISA's specified due dates. For private-sector organizations, the KEV due date is effectively your SLA too — attackers do not distinguish between federal and commercial targets, and neither should your patch prioritization.

Technical Analysis

CVE-2026-33824 — Microsoft IKE Service Extensions Double Free

The Internet Key Exchange service (IKEEXT, hosted in svchost.exe) implements the IKE and AuthIP protocols used to establish IPsec security associations — the backbone of Windows-based site-to-site and remote-access VPNs. A double free vulnerability occurs when memory is released to the allocator twice, corrupting heap metadata and creating a path to arbitrary code execution or denial of service.

From a defender's perspective, the critical facts are:

• The vulnerable component listens on UDP 500 (IKE) and UDP 4500 (NAT-T) — meaning exploitation is likely remote and potentially unauthenticated, triggered by malformed IKE negotiation packets.
• IKEEXT runs with SYSTEM-level privileges inside a shared service host. Successful exploitation hands an attacker the highest privilege context on the host without ever touching disk with traditional malware tooling.
• Double free exploitation typically produces observable instability before or after success: service crashes, svchost.exe restarts, or anomalous child processes if the attacker achieves code execution and uses the service context to spawn follow-on tooling.

Any Windows Server terminating IPsec tunnels — branch office VPN concentrators, Always On VPN servers, or servers peering with Azure VPN Gateways — is a priority target.

CVE-2026-55040 — Microsoft SharePoint Weak Authentication

Weak authentication flaws in SharePoint historically follow a familiar and devastating pattern: an authentication or token-validation weakness allows a remote attacker to impersonate a legitimate user or service principal, after which they upload web shells, plant malicious ASPX payloads in Layouts directories, and pivot into the broader network. SharePoint servers sit inside the perimeter, hold highly sensitive document repositories, and almost always have line-of-sight to Active Directory — which is exactly why they've been a favorite initial-access target for years.

Defensive indicators to focus on:

• The IIS worker process (w3wp.exe) serving the SharePoint application pool spawning command interpreters, script engines, or encoded PowerShell — a hallmark of post-exploitation on SharePoint.
• Unexpected file writes to SharePoint virtual directories (C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\ and site Layouts folders), particularly .aspx, .ashx, or .asmx files.
• Authentication events from service accounts or machine accounts originating from the SharePoint server itself at unusual hours or to unusual resources — evidence of token abuse following the weak-auth bypass.

CVE-2026-59310 — Broadcom VMware vCenter Path Traversal

Path traversal in vCenter's web services allows an attacker to break out of the intended web root and read (and in some cases write) arbitrary files on the vCenter Server Appliance or Windows-based vCenter host. Depending on the affected endpoint, exploitation may be unauthenticated and reachable from any network position that can hit the vCenter management interface (TCP 443).

The exploitation chain defenders should model:

1. Attacker sends crafted HTTP requests containing ../ sequences or URL-encoded variants (%2e%2e%2f, ..%2f, double-encoded %252e) to a vulnerable vCenter endpoint.
2. Traversal yields access to sensitive files — on the VCSA, targets of interest include /etc/passwd, vCenter database credentials, SAML signing keys, and session artifacts under /storage/, /var/, and Tomcat working directories.
3. Credential or key material recovered via traversal is replayed to establish authenticated sessions, deploy web shells (historically dropped under Tomcat webapp directories), and ultimately reach the ESXi hosts and guest VMs below.

vCenter compromise is a force multiplier — one exploited appliance can mean ransomware across every datastore in the environment.

CVE-2026-65400 — Apple macOS Improper Authentication

Improper authentication in macOS generally means a system service or authorization path accepts credentials, tokens, or entitlements it shouldn't — allowing a local attacker (or a malicious application) to elevate privileges or access protected resources without valid authentication. On macOS, the components most commonly implicated in this bug class include authd (Authorization Services), System Settings extensions, and TCC-adjacent services.

Operationally, expect this flaw to be chained: an attacker gains initial code execution via phishing or a malicious application, then uses the improper authentication bug to escape the user context, disable or bypass security controls, and establish persistence as root. Detection therefore centers on unexpected privilege transitions and anomalous child processes of system authorization daemons.

Exploitation Status

All four CVEs are in the CISA KEV Catalog as of August 18, 2026, which by definition means CISA has reliable evidence of active exploitation. Treat all four as exploited in the wild and prioritize accordingly. BOD 26-04 obligates FCEB agencies to remediate within the deadlines published in the KEV catalog; private organizations should adopt the same dates as internal SLAs.

Detection & Response

The detections below target the post-exploitation behaviors most likely to be observable for each flaw. Tune thresholds to your environment before deployment, and run these as retro-hunts going back at least 30 days — if exploitation is active, you may already have artifacts.

Sigma Rules

---
title: SharePoint IIS Worker Process Spawning Command Interpreter
id: 8c1f4a72-3b6d-4e91-a7c2-9f0d5e6b1234
status: experimental
description: Detects the SharePoint IIS worker process spawning command shells or script engines, consistent with post-exploitation following weak authentication bypass such as CVE-2026-55040.
references:
  - https://www.cisa.gov/news-events/alerts/2026/08/18/cisa-adds-four-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/08/18
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare SharePoint administrative tooling invoking scripts; verify parent application pool identity and command line
level: high
---
title: IKEEXT Service Host Anomalous Child Process
id: 2d7e9b41-5c3a-4f08-b1d6-8a4c7e2f9012
status: experimental
description: Detects child processes spawned by svchost instances hosting the IKEEXT service, a strong indicator of code execution achieved through exploitation of the IKE double free (CVE-2026-33824).
references:
  - https://www.cisa.gov/news-events/alerts/2026/08/18/cisa-adds-four-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/18
tags:
  - attack.execution
  - attack.t1059
  - attack.privilege_escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\svchost.exe'
    ParentCommandLine|contains: 'IKEEXT'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\wmic.exe'
      - '\net.exe'
      - '\net1.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Virtually none; IKEEXT should never spawn interactive tooling
level: critical
---
title: VMware vCenter Path Traversal Attempt in Web Logs
id: 6a3c8d15-9e2b-4f74-a5c1-7b8d3e0f2468
status: experimental
description: Detects HTTP requests containing path traversal sequences targeting VMware vCenter services, consistent with exploitation attempts against CVE-2026-59310.
references:
  - https://www.cisa.gov/news-events/alerts/2026/08/18/cisa-adds-four-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/18
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_traversal:
    cs-uri|contains:
      - '../'
      - '..%2f'
      - '%2e%2e%2f'
      - '%2e%2e/'
      - '..%255c'
      - '%252e%252e'
  selection_target:
    cs-host|contains:
      - 'vcenter'
      - 'vcsa'
  condition: selection_traversal and selection_target
falsepositives:
  - Vulnerability scanners and authorized penetration tests; correlate source IP with known scanner ranges
level: high

KQL — Microsoft Sentinel / Defender

// Hunt 1: SharePoint post-exploitation — w3wp spawning shells or script engines (CVE-2026-55040)
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc;

// Hunt 2: IKEEXT exploitation — crashes/restarts of the IKE service host and anomalous UDP 500/4500 traffic (CVE-2026-33824)
let IKECrash = SecurityEvent
| where TimeGenerated > ago(30d)
| where EventID in (7031, 7034)  // Service Control Manager: unexpected service termination
| where EventData has "IKEEXT" or CommandLine has "IKEEXT";
let IKETraffic = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemotePort in (500, 4500) and RemoteIPType == "Public"
| summarize ConnectionCount = count(), RemoteIPs = make_set(RemoteIP) by DeviceName, bin(TimeGenerated, 1h)
| where ConnectionCount > 500;  // Tune to baseline; spikes may indicate exploit scanning/fuzzing
IKECrash;
IKETraffic;

// Hunt 3: vCenter traversal via Syslog/CEF ingestion (CVE-2026-59310)
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where RequestURL has_any ("../", "..%2f", "%2e%2e", "%252e")
| where DeviceProduct has "vCenter" or DestinationHostName has_any ("vcenter", "vcsa") or DestinationPort == 443
| summarize Attempts = count(), URIs = make_set(RequestURL, 20) by SourceIP, DestinationHostName, bin(TimeGenerated, 1h)
| order by Attempts desc;

// Hunt 4: macOS improper authentication — suspicious child processes of authd/authorization services (CVE-2026-65400)
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where DeviceOsType == "MacOS" or InitiatingProcessFileName in ("authd", "securityd", "authorizationhost")
| where FileName in~ ("bash", "zsh", "sh", "python", "osascript", "curl") or ProcessCommandLine has_any ("chmod +x", "launchctl", "dscl")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by TimeGenerated desc;

Velociraptor VQL

-- Hunt for web shells and suspicious child processes on SharePoint and Windows servers
-- Artifact 1: recently written scriptable files in SharePoint/IIS web roots
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/inetpub/**/*.aspx',
  'C:/inetpub/**/*.ashx',
  'C:/Program Files/Common Files/Microsoft Shared/Web Server Extensions/**/*.aspx',
  'C:/Program Files/Common Files/Microsoft Shared/Web Server Extensions/**/*.ashx'
])
WHERE Mtime > now() - 2592000  -- Last 30 days
ORDER BY Mtime DESC;

-- Artifact 2: process execution where a web or service host spawned a shell (SharePoint / IKEEXT post-exploitation)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(powershell|cmd\.exe|mshta|rundll32|certutil|bitsadmin)'
  AND (
    (SELECT Name FROM pslist(pid=Ppid)) =~ '(?i)w3wp'
    OR (SELECT CommandLine FROM pslist(pid=Ppid)) =~ '(?i)IKEEXT'
  );

Remediation Script

The following PowerShell audits Windows systems for KEV exposure (IKE and SharePoint hosts), verifies the IKEEXT service state, and inventories recent suspicious file drops in SharePoint web roots. Run it elevated on candidate servers; feed output back to your vulnerability management platform.

# Security Arsenal - CISA KEV Aug 2026 Triage Script
# Covers CVE-2026-33824 (IKE), CVE-2026-55040 (SharePoint) host-side checks
$ErrorActionPreference = 'SilentlyContinue'
$report = @{}

# 1) Check whether IKEEXT exists and its current state (target for CVE-2026-33824)
$ike = Get-Service -Name IKEEXT
$report['IKEEXT_Status'] = if ($ike) { "$($ike.Status) / StartType: $($ike.StartType)" } else { 'Not present' }

# 2) Confirm latest cumulative update installed (verify against Microsoft advisory for CVE-2026-33824 / CVE-2026-55040)
$hotfix = Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1
$report['Latest_Hotfix'] = "$($hotfix.HotFixID) installed $($hotfix.InstalledOn)"
$report['OS_Build'] = (Get-CimInstance Win32_OperatingSystem).BuildNumber

# 3) Detect SharePoint presence and recent file drops in web roots (post-exploitation artifacts)
$spPaths = @('C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions', 'C:\inetpub')
$cutoff = (Get-Date).AddDays(-30)
$drops = foreach ($p in $spPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -Include *.aspx,*.ashx,*.asmx,*.dll |
            Where-Object { $_.LastWriteTime -gt $cutoff } |
            Select-Object FullName, LastWriteTime
    }
}
$report['Recent_WebRoot_Files'] = if ($drops) { $drops.Count } else { 0 }
$drops | Format-Table -AutoSize

# 4) Recent service crashes for IKEEXT (possible exploitation attempts causing double-free instability)
$crashes = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7031,7034; StartTime=$cutoff} |
    Where-Object { $_.Message -match 'IKEEXT|IKE and AuthIP' } |
    Select-Object TimeCreated, Message
$report['IKEEXT_Crashes_30d'] = if ($crashes) { $crashes.Count } else { 0 }

# 5) Flag exposure: internet-facing UDP 500/4500 listeners
$listeners = Get-NetUDPEndpoint -LocalPort 500,4500
$report['IKE_Listeners'] = if ($listeners) { 'EXPOSED - verify patch immediately' } else { 'None' }

$report.GetEnumerator() | Sort-Object Name | Format-Table -AutoSize
Write-Host "`nACTION: Cross-reference OS build and SharePoint CU level against Microsoft advisories for CVE-2026-33824 and CVE-2026-55040. If Recent_WebRoot_Files or IKEEXT_Crashes_30d are non-zero on an internet-facing host, escalate to IR."

For vCenter and macOS assets, run the following Bash triage on the respective platforms (via SSH to the VCSA shell and via your MDM or manual execution for macOS).

# vCenter Server Appliance: check version/build against Broadcom advisory for CVE-2026-59310
# and hunt Tomcat/web logs for traversal attempts
/usr/lib/applmgmt/support/scripts/applmgmt.sh --version 2>/dev/null || vpxd -v
grep -rEi '(\.\./|\.\.%2f|%2e%2e|%252e)' /var/log/vmware/ /var/log/lighttpd/ /var/log/envoy/ 2>/dev/null | tail -50
ls -lat /usr/lib/vmware-*/server/webapps/ 2>/dev/null | head -20   # unexpected recent webapp drops = web shell risk

# macOS: verify OS version against Apple security release addressing CVE-2026-65400
sw_vers
softwareupdate --list
# Review unified log for anomalous authorization activity in the last 7 days
log show --last 7d --predicate 'subsystem == "com.apple.Authorization" OR process == "authd"' --style compact 2>/dev/null | grep -iE 'denied|error|fail' | tail -40

Remediation

1. Patch immediately, in KEV priority order. Apply the vendor security updates addressing all four CVEs:

• CVE-2026-33824 / CVE-2026-55040 (Microsoft): Deploy the August 2026 (or later) cumulative updates per the Microsoft Security Update Guide entries for each CVE. Prioritize internet-facing VPN/IKE hosts and any SharePoint server reachable from untrusted networks. Verify SharePoint-specific updates applied successfully — SharePoint patching requires running the Products Configuration Wizard after binary installation; a half-patched farm is still vulnerable.
• CVE-2026-59310 (Broadcom/VMware): Upgrade vCenter Server to the fixed build listed in Broadcom's security advisory (VMSA). Confirm the exact patched build number against the advisory rather than assuming your current minor release is covered.
• CVE-2026-65400 (Apple): Update macOS fleets to the release referenced in Apple's security advisory. Enforce via MDM with a deadline — do not rely on user-initiated updates for a KEV-listed flaw.

Official sources: the CISA KEV Catalog, Microsoft Security Update Guide, Broadcom support advisories, and Apple Security Releases.

2. Honor the BOD 26-04 deadlines. FCEB agencies must remediate within the due dates CISA assigns in the KEV entries. Private organizations should adopt those same dates internally and report status to leadership — KEV additions with active exploitation are board-level patch events.

3. Apply mitigations where patching must wait. Restrict network exposure: limit UDP 500/4500 to known VPN peers via host firewall and perimeter ACLs; place vCenter management interfaces behind a management network/jump host with no direct internet or broad internal reachability; restrict SharePoint access through authenticated reverse proxies where feasible. These reduce — but do not eliminate — risk; patching remains the only complete fix.

4. Assume breach and retro-hunt. Because all four flaws are confirmed exploited, run the detections above across at least 30 days of telemetry. Pay special attention to vCenter appliances and SharePoint servers: if you find web shells, anomalous file drops, IKEEXT crashes, or suspicious authentication patterns, treat it as an incident — preserve evidence, isolate the host, and initiate your IR process. KEV exploitation frequently predates the catalog listing by weeks or months.

5. Fix the systemic gap. Four KEV additions in one day, across four different vendors, is the recurring argument for risk-based vulnerability management: KEV membership must automatically override CVSS-based patch queues. If your VM program still triages primarily on scanner severity scores, this advisory is your evidence for changing that.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub