CISA KEV Flash: 8 CVEs Added — TrueConf, VMware vCenter & Microsoft SharePoint Under Active Attack | Security Arsenal

The CISA Known Exploited Vulnerabilities (KEV) catalog added eight CVEs between August 17–20, 2026, confirming active in-the-wild exploitation across collaboration platforms, virtualization infrastructure, enterprise content management, and ML/AI tooling. This batch is notable for its concentration of unauthenticated remote code execution and authentication bypass primitives — the exact vulnerability classes ransomware operators and initial access brokers (IABs) prioritize for perimeter intrusion.

Federal Civilian Executive Branch (FCEB) agencies are bound by BOD 22-01 remediation deadlines. Enterprise organizations should treat every entry below as a drop-everything patch priority.

Active Exploitation Intelligence

CVE-2026-72530 — TrueConf Server Code Injection (Added 2026-08-20)

Vulnerability: Code injection in TrueConf Server reachable by an unauthorized remote attacker with network access to port 4307/TCP.
Exploitation method: Remote code execution. An unauthenticated attacker can inject and execute arbitrary code in the context of the TrueConf service, which commonly runs with elevated privileges on Windows and Linux servers.
Threat actors: CISA lists ransomware use as Unknown; however, video-conferencing infrastructure sits directly on corporate networks and is a high-value lateral-movement beachhead. No public attribution at time of writing.
CVSS: Not yet published by NVD at time of analysis. Treat as Critical pending scoring.
PoC: No confirmed public PoC. Exploitation confirmed by CISA via telemetry.
CISA required action: Apply vendor mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CVE-2026-72529 — TrueConf Server Missing Authentication for Critical Function (Added 2026-08-20)

Vulnerability: Missing authentication on a critical administrative function in TrueConf Server.
Exploitation method: Authentication bypass leading to administrative control; trivially chainable with CVE-2026-72530 for full unauthenticated RCE.
Threat actors: Ransomware use Unknown. Expect opportunistic scanning — missing-auth flaws are among the fastest to be weaponized at scale.
CVSS: Not yet published. Treat as Critical.
PoC: Not confirmed public.
CISA required action: Apply vendor mitigations or discontinue use.

CVE-2026-64849 — MLflow Server-Side Request Forgery (Added 2026-08-19)

Vulnerability: SSRF in MLflow allowing attackers to reach internal or cloud metadata services (e.g., 169.254.169.254).
Exploitation method: SSRF → cloud credential theft. By forcing the MLflow server to request the IMDS endpoint, attackers harvest temporary IAM credentials and pivot into the cloud control plane.
Threat actors: Ransomware use Unknown. SSRF-to-metadata is a staple of cloud-focused intrusion sets and cryptomining crews; MLflow instances are frequently internet-exposed on default ports (5000).
CVSS: Not yet published. Treat as High–Critical in cloud deployments.
PoC: Not confirmed public; SSRF exploitation patterns against MLflow are well documented historically.
CISA required action: Apply vendor mitigations or discontinue use.

CVE-2026-33824 — Microsoft IKE Service Extensions Double Free (Added 2026-08-18)

Vulnerability: Double free in the Microsoft Internet Key Exchange (IKE) Service Extensions enabling remote code execution.
Exploitation method: Remote, network-based memory corruption against the IKE service (IPsec/VPN negotiation, UDP 500/4500). Successful exploitation yields code execution at SYSTEM-level context on the host.
Threat actors: Ransomware use Unknown. Memory-corruption RCEs in Windows network services are prime candidates for exploit-kit integration and wormable spread.
CVSS: Not yet published. Treat as Critical.
PoC: Not confirmed public. Double-free exploitation requires heap grooming expertise — expect a lag before broad weaponization, but nation-state capability should be assumed.
CISA required action: Apply Microsoft security updates.

CVE-2026-59310 — Broadcom VMware vCenter Path Traversal (Added 2026-08-18)

Vulnerability: Path traversal in VMware vCenter allowing a threat actor with network access to vCenter to execute arbitrary files/commands.
Exploitation method: Path traversal → file write/read → RCE. Historical precedent (CVE-2021-21972, CVE-2021-22005) shows vCenter traversal flaws achieve mass exploitation within 24–72 hours of disclosure.
Threat actors: Ransomware use Unknown — but vCenter is the single most-targeted virtualization asset by ransomware groups (ESXi encryptors: Black Basta, Akira, LockBit affiliates have all leveraged vCenter compromise). Treat as imminent ransomware risk.
CVSS: Not yet published. Treat as Critical.
PoC: Not confirmed public.
CISA required action: Apply Broadcom/VMware security updates.

CVE-2026-55040 — Microsoft SharePoint Weak Authentication (Added 2026-08-18)

Vulnerability: Weak authentication allowing an unauthorized attacker to bypass a security feature over the network.
Exploitation method: Authentication bypass over the network against on-premises SharePoint, enabling unauthorized access to sites, documents, and — in chained scenarios — code execution.
Threat actors: Ransomware use Unknown. SharePoint auth bypasses have a documented history of nation-state exploitation (ToolShell chain, 2025) and rapid criminal adoption for data theft/extortion.
CVSS: Not yet published. Treat as Critical for internet-facing SharePoint.
PoC: Not confirmed public.
CISA required action: Apply Microsoft security updates; ensure AMSI integration is enabled.

CVE-2026-65400 — Apple macOS Screen Sharing Improper Authentication (Added 2026-08-18)

Vulnerability: Improper authentication allowing a network attacker to authenticate to Screen Sharing.
Exploitation method: Authentication bypass over the network → full remote desktop session with the logged-in user's context. Enables hands-on-keyboard access, credential theft from keychain, and staged lateral movement.
Threat actors: Ransomware use Unknown. macOS exploitation in KEV typically correlates with targeted intrusions rather than mass ransomware.
CVSS: Not yet published. Treat as High–Critical where Screen Sharing/VNC (TCP 5900) is enabled.
PoC: Not confirmed public.
CISA required action: Apply Apple security updates; disable Screen Sharing where not required.

CVE-2025-62593 — Ray-Project Ray Code Injection (Added 2026-08-17)

Vulnerability: Code injection in the Ray distributed computing framework enabling remote code execution.
Exploitation method: Unauthenticated RCE via Ray's dashboard/jobs API (TCP 8265). Developers and production ML clusters running Ray are directly exposed; Ray dashboards are notoriously deployed without authentication.
Threat actors: Ransomware use Unknown. Historical precedent: the CVE-2023-48022 "ShadowRay" campaign saw Ray clusters exploited at scale for cryptomining and data theft by Oligo-documented actors. Expect identical TTPs.
CVSS: Refer to NVD for the published score for this 2025 CVE.
PoC: Exploitation techniques for Ray's jobs API are well understood publicly.
CISA required action: Apply vendor mitigations; restrict dashboard exposure.

Affected Organizations Assessment

Exposed enterprise environments:

Video collaboration: Organizations running self-hosted TrueConf Server — common in government, legal, healthcare, and organizations with data-sovereignty requirements that preclude cloud conferencing.
Virtualization: Any environment with vCenter Server — effectively the majority of enterprise datacenters. vCenter compromise = keys to every ESXi host and VM.
Collaboration/CMS: On-premises Microsoft SharePoint (Subscription Edition, 2019, 2016) — heavily deployed in government, finance, defense industrial base.
Windows networking: Any Windows host running IKE/IPsec services — VPN gateways, DirectAccess, Always On VPN endpoints.
ML/AI infrastructure: MLflow tracking servers and Ray clusters — frequently deployed by data science teams outside IT/security governance (shadow AI infrastructure), commonly internet-exposed and unpatched.
macOS fleets: Creative, executive, and developer endpoints with Screen Sharing enabled.

Estimated exposure scale: vCenter patch adoption historically lags 30–60 days post-advisory due to change-control friction around virtualization infrastructure. SharePoint on-prem patching similarly lags; legacy 2016/2019 instances remain prevalent. MLflow and Ray exposure is undercounted industry-wide because these tools rarely appear in formal asset inventories — shadow deployments on cloud VMs and data-science workstations are the norm. TrueConf exposure is smaller in absolute numbers but concentrated in high-sensitivity environments.

Sectors with fastest historical exploitation for these product types:

vCenter/ESXi: Healthcare, manufacturing, and education — targeted by ransomware affiliates for maximum operational disruption.
SharePoint: Government, defense, energy, legal — espionage and data-extortion actors.
ML tooling (Ray/MLflow): Technology and research sectors — cryptomining crews and cloud credential thieves.
Windows network services: Cross-sector opportunistic exploitation via internet scanning.

Detection Engineering

Sigma Rules

The following rules target observable exploitation behaviors for the highest-impact CVEs in this batch: TrueConf service child-process spawning (CVE-2026-72530), MLflow SSRF to cloud metadata (CVE-2026-64849), and vCenter path traversal in web logs (CVE-2026-59310).

YAML

---
title: TrueConf Server Suspicious Child Process Execution
id: 9f4a1c2e-7b3d-4e5a-8f6c-202608200001
status: experimental
description: Detects suspicious child processes spawned by the TrueConf Server process, consistent with post-exploitation activity following CVE-2026-72530 code injection via port 4307/TCP
author: Security Arsenal Threat Intel
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/08/20
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\trueconf\server\trueconfserver.exe'
            - '\tc_server.exe'
        ParentCommandLine|contains: 'trueconf'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate TrueConf administrative scripts (rare)
level: critical
tags:
    - attack.execution
    - attack.t1059
    - cve.2026.72530
---
title: MLflow Server SSRF to Cloud Metadata Service
id: 9f4a1c2e-7b3d-4e5a-8f6c-202608190002
status: experimental
description: Detects outbound connections from the MLflow server process to cloud instance metadata endpoints, indicative of CVE-2026-64849 SSRF exploitation for IAM credential theft
author: Security Arsenal Threat Intel
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/08/19
logsource:
    category: network_connection
    product: windows
detection:
    selection_process:
        Image|endswith:
            - '\python.exe'
            - '\python3.exe'
        CommandLine|contains: 'mlflow'
    selection_dest:
        DestinationIp:
            - '169.254.169.254'
            - '169.254.170.2'
            - '100.100.100.200'
        DestinationHostname|contains:
            - 'metadata.google.internal'
    condition: selection_process and selection_dest
falsepositives:
    - None expected; MLflow has no legitimate reason to query IMDS directly
level: critical
tags:
    - attack.credential_access
    - attack.t1552.005
    - attack.t1190
    - cve.2026.64849
---
title: VMware vCenter Path Traversal Exploitation Attempt
id: 9f4a1c2e-7b3d-4e5a-8f6c-202608180003
status: experimental
description: Detects path traversal sequences in HTTP requests to VMware vCenter services consistent with CVE-2026-59310 exploitation attempts
author: Security Arsenal Threat Intel
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/08/18
logsource:
    category: webserver
detection:
    selection_uri:
        cs-uri|contains:
            - '..%2f'
            - '..%5c'
            - '%2e%2e%2f'
            - '%2e%2e/'
            - '../'
            - '..\\'
    selection_host:
        cs-host|contains:
            - 'vcenter'
            - 'vcsa'
    selection_status:
        sc-status:
            - 200
            - 201
            - 302
    condition: selection_uri and selection_host and selection_status
falsepositives:
    - Legitimate vSphere Client requests are not expected to contain traversal sequences; investigate all hits
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026.59310

KQL — Microsoft Sentinel Hunt Query

This query hunts across the batch: suspicious child processes from TrueConf/Ray/MLflow service contexts, connections to cloud metadata from ML tooling, and external connections to TrueConf port 4307 and IKE UDP 500 from untrusted sources.

KQL — Microsoft Sentinel / Defender

// KEV Wave Aug 17-20 2026: Hunt for exploitation indicators across TrueConf, MLflow, Ray, IKE, vCenter
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","certutil.exe","bitsadmin.exe","curl.exe","wget.exe","sh","bash"]);
let ServiceParents = dynamic(["trueconf","tc_server","mlflow","raylet","ray::","gunicorn","vpxd","w3wp"]);
let MetadataIPs = dynamic(["169.254.169.254","169.254.170.2","100.100.100.200"]);
union isfuzzy=true
    (DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessCommandLine has_any (ServiceParents) or InitiatingProcessFileName has_any (ServiceParents)
    | where FileName in~ (SuspiciousChildren)
    | project TimeGenerated, DeviceName, AlertType="ServiceChildProcess", InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, ReportId),
    (DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where (InitiatingProcessCommandLine has_any ("mlflow","ray") and RemoteIP in~ (MetadataIPs))
         or (RemotePort == 4307 and ActionType == "InboundConnectionAccepted")
         or (RemotePort == 8265 and ActionType == "InboundConnectionAccepted" and not(RemoteIP startswith "10.") and not(RemoteIP startswith "192.168."))
         or (RemotePort == 5900 and ActionType == "InboundConnectionAccepted" and InitiatingProcessFileName =~ "screensharingd")
    | project TimeGenerated, DeviceName, AlertType="SuspiciousInboundOrSSRF", InitiatingProcessFileName, RemoteIP, RemotePort, LocalPort, ReportId)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hits=count() by DeviceName, AlertType, InitiatingProcessFileName, FileName, RemoteIP, RemotePort
| order by Hits desc

Remediation & Inventory Script

The following PowerShell script inventories exposed products across the batch, verifies patch/mitigation status, and applies compensating controls where possible.

PowerShell

# Security Arsenal — KEV Wave 2026-08-17..20 Inventory & Mitigation Script
# Run elevated. Outputs JSON inventory to C:\ProgramData\SecArsenal\KEV_Aug2026_Report.json
$ErrorActionPreference = 'SilentlyContinue'
$report = [ordered]@{ Host=$env:COMPUTERNAME; ScanTime=(Get-Date -Format o); Findings=@() }

function Add-Finding($Product,$CVE,$Status,$Detail){
    $script:report.Findings += [pscustomobject]@{Product=$Product;CVE=$CVE;Status=$Status;Detail=$Detail}
}

# --- 1. TrueConf Server (CVE-2026-72530 / CVE-2026-72529) ---
$tc = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
      'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' |
      Where-Object { $_.DisplayName -match 'TrueConf' }
if ($tc) {
    $ver = $tc[0].DisplayVersion
    Add-Finding 'TrueConf Server' 'CVE-2026-72530/72529' 'EXPOSED-VERIFY-VENDOR-PATCH' "Installed version: $ver"
    # Compensating control: restrict TCP 4307 to trusted management subnet until patched
    if (-not (Get-NetFirewallRule -DisplayName 'SA-KEV-TrueConf-4307-Restrict')) {
        New-NetFirewallRule -DisplayName 'SA-KEV-TrueConf-4307-Restrict' -Direction Inbound `
            -Protocol TCP -LocalPort 4307 -RemoteAddress '10.0.0.0/8' -Action Allow | Out-Null
        New-NetFirewallRule -DisplayName 'SA-KEV-TrueConf-4307-Block' -Direction Inbound `
            -Protocol TCP -LocalPort 4307 -Action Block | Out-Null
        Add-Finding 'TrueConf Server' 'CVE-2026-72530' 'MITIGATION-APPLIED' 'Firewall: TCP 4307 restricted to RFC1918 management range'
    }
} else { Add-Finding 'TrueConf Server' 'CVE-2026-72530/72529' 'NOT-INSTALLED' '' }

# --- 2. MLflow (CVE-2026-64849) & Ray (CVE-2025-62593) via pip ---
foreach ($pkg in @(@{n='mlflow';c='CVE-2026-64849'},@{n='ray';c='CVE-2025-62593'})) {
    $installed = pip show $($pkg.n) 2>$null | Select-String '^Version:'
    if ($installed) {
        $v = ($installed -split ':')[1].Trim()
        Add-Finding $pkg.n $pkg.c 'EXPOSED-UPGRADE-REQUIRED' "pip version installed: $v"
        Write-Host "[!] $($pkg.n) $v detected. Upgrade: pip install --upgrade $($pkg.n)" -ForegroundColor Yellow
    } else { Add-Finding $pkg.n $pkg.c 'NOT-INSTALLED' '' }
}

# --- 3. Microsoft IKE (CVE-2026-33824): check for August 2026 cumulative update ---
$hotfixes = Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date '2026-08-01') }
$ikeSvc = Get-Service -Name 'IKEEXT'
if ($ikeSvc) {
    if ($hotfixes) { Add-Finding 'Microsoft IKEEXT' 'CVE-2026-33824' 'PATCH-CANDIDATE-PRESENT' "Latest update: $($hotfixes[-1].HotFixID) $($hotfixes[-1].InstalledOn)" }
    else {
        Add-Finding 'Microsoft IKEEXT' 'CVE-2026-33824' 'UNPATCHED' 'No updates installed since 2026-08-01; IKEEXT state: '$ikeSvc.Status
        if ($ikeSvc.Status -eq 'Running' -and -not (Get-NetFirewallRule -DisplayName 'SA-KEV-IKE-UDP500-Block')) {
            # Only apply on hosts NOT serving as VPN gateways — review before broad deployment
            Write-Host '[!] IKEEXT running. If this host is not an IPsec VPN endpoint, disable: Set-Service IKEEXT -StartupType Disabled' -ForegroundColor Yellow
        }
    }
}

# --- 4. SharePoint on-prem presence (CVE-2026-55040) ---
$sp = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\16.0'
if ($sp) { Add-Finding 'Microsoft SharePoint' 'CVE-2026-55040' 'EXPOSED-APPLY-AUG2026-SU' 'SharePoint 16.0 hive present; verify Aug 2026 security update + AMSI enabled' }
else { Add-Finding 'Microsoft SharePoint' 'CVE-2026-55040' 'NOT-DETECTED' '' }

# --- 5. macOS Screen Sharing (run on mac endpoints via MDM; Windows skip) ---
# MDM command reference: sudo launchctl disable system/com.apple.screensharing
Add-Finding 'Apple macOS' 'CVE-2026-65400' 'MDM-SCOPE' 'Enforce via MDM: disable com.apple.screensharing until Ventura/Sonoma/Sequoia patched builds deployed'

# --- Output ---
New-Item -ItemType Directory -Path 'C:\ProgramData\SecArsenal' -Force | Out-Null
$report | ConvertTo-Json -Depth 4 | Out-File 'C:\ProgramData\SecArsenal\KEV_Aug2026_Report.json'
$report.Findings | Format-Table -AutoSize
Write-Host "Report written to C:\ProgramData\SecArsenal\KEV_Aug2026_Report.json" -ForegroundColor Cyan

# --- Validation ---
# TrueConf:  Test-NetConnection <host> -Port 4307 from untrusted segment -> should FAIL post-mitigation
# MLflow:    pip show mlflow -> confirm version >= patched release; verify egress ACL denies 169.254.169.254 from app servers
# Ray:       Confirm dashboard (8265) bound to localhost or behind authenticated reverse proxy
# IKE:       Get-HotFix shows Aug 2026 CU; Get-Service IKEEXT disabled where not required
# SharePoint: Confirm Aug 2026 SU build via Central Administration > Check product and patch installation status

Patch & Remediation Priorities

Priority 1 — Patch within 24–72 hours (internet-facing / ransomware-magnet infrastructure):

CVE-2026-59310 — VMware vCenter: Apply the latest Broadcom vCenter Server patch per the Broadcom Security Advisory portal (broadcom.com/support/security-center). vCenter is the highest-blast-radius asset in this batch — compromise cascades to every ESXi host and guest VM. Workaround: restrict vCenter management interfaces (443/5480) to a dedicated management VLAN; never expose vCenter to the internet.
CVE-2026-55040 — Microsoft SharePoint: Apply the August 2026 SharePoint security update via Microsoft Update / the Microsoft Security Update Guide (msrc.microsoft.com). Workaround: place SharePoint behind a WAF/VPN, enable AMSI integration, rotate the machine keys after patching.
CVE-2026-33824 — Microsoft IKE Service Extensions: Deploy the August 2026 Windows cumulative update. Workaround: disable the IKEEXT service on hosts not functioning as IPsec VPN endpoints.

Priority 2 — Patch within 7 days: 4. CVE-2026-72530 / CVE-2026-72529 — TrueConf Server: Apply vendor updates from the TrueConf support portal (trueconf.com). These two flaws are chainable for unauthenticated RCE — patch both together. Workaround: firewall TCP 4307 to trusted subnets only. 5. CVE-2026-64849 — MLflow: Upgrade to the patched MLflow release (pip install --upgrade mlflow; see github.com/mlflow/mlflow security advisories). Workaround: bind MLflow to localhost, front it with an authenticated reverse proxy, and apply egress filtering blocking 169.254.169.254 from application workloads; enforce IMDSv2 on AWS. 6. CVE-2025-62593 — Ray: Upgrade Ray and never expose the dashboard (TCP 8265) without authentication. Reference: github.com/ray-project/ray security policy and the Anyscale security bulletins.

Priority 3 — Patch within 14 days: 7. CVE-2026-65400 — Apple macOS: Deploy the latest macOS rapid security response / point release via MDM. Workaround: disable Screen Sharing (com.apple.screensharing) fleet-wide; use authenticated remote management tooling instead.

CISA compliance deadlines: Under BOD 22-01, FCEB agencies must remediate KEV entries by the due date assigned in the catalog (typically ~3 weeks from the "Date Added" — expect deadlines in early-to-mid September 2026 for this batch; verify exact per-CVE due dates at cisa.gov/known-exploited-vulnerabilities-catalog). Where mitigations are unavailable, CISA directs agencies to discontinue use of the product.

Bottom line: This KEV wave hands attackers a full intrusion kill-chain toolkit — perimeter RCE (TrueConf, IKE, vCenter, Ray), auth bypass (SharePoint, macOS), and cloud credential theft (MLflow SSRF). Assume internet-facing instances of these products are already being scanned. Patch Priority 1 items now, hunt with the detections above, and treat any hit as a full incident until proven otherwise.

Related Resources

Security Arsenal Penetration Testing Managed SOC & MDR AlertMonitor Platform From The Dark Side Intel Hub

CISA KEV Flash: 8 CVEs Added — TrueConf, VMware vCenter & Microsoft SharePoint Under Active Attack