Critical macOS, Share Point, vCenter, and Microsoft IKE Flaws Under Active Exploitation
Summary: CISA added four critical vulnerabilities to its Known Exploited Vulnerabilities catalog on Tuesday, covering flaws in Apple macOS, SharePoint, VMware vCenter, and Microsoft Internet Key Exchange, all of which have been patched but are being exploited in the wild. The macOS flaw delivered a Monero cryptocurrency miner, the vCenter flaw was assessed to have been exploited by a suspected China-nexus APT to deploy a backdoor and reverse_ssh binaries, with at least one case leading to Babuk-derived ransomware and 361 unique victim IP addresses compromised across 47 countries.
Bottom line: The vCenter campaign alone reached 361 unique victim IP addresses in 47 countries, and a separate Chinese-speaking actor was observed running an AI-enabled autonomous hacking campaign with DeepSeek alongside manual exploitation of the Microsoft IKE flaw. FCEB agencies have until August 21, 2026, to patch under BOD 26-04, a deadline that implies the exposure window for everyone else is already open.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-33824
- Related
- CVE-2026-33824: Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability Known Exploited Vulnerabilities · Aug 18, 2026