Listen to this Post
Introduction:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. These flaws—spanning Apple macOS Screen Sharing, Microsoft SharePoint, VMware vCenter, and Microsoft Windows IKE Service Extensions—carry CVSS scores of 9.1 to 9.8 and are being leveraged by threat actors ranging from China-1exus APT groups to AI-enabled autonomous hacking campaigns. With 361 unique victim IP addresses across 47 countries already compromised, including Germany (55), the U.S. (41), Turkey (38), Iran (26), and France (25), the window for remediation is closing fast. Federal Civilian Executive Branch (FCEB) agencies have until August 21, 2026, to patch under Binding Operational Directive 26-04.
Learning Objectives & Secrets:
- Objective 1: Understand the technical mechanics of CVE-2026-65400 (macOS Screen Sharing auth bypass), CVE-2026-55040 (SharePoint JWT authentication bypass), CVE-2026-59310 (vCenter path traversal to RCE), and CVE-2026-33824 (Windows IKE double free RCE)—and how each is being weaponized in active campaigns.
-
Objective 2 (Secret Tip): Treat CISA KEV as your minimum patching baseline, not your complete one. Attackers are weaponizing these flaws within days—sometimes hours—of PoC release. For CVE-2026-55040, exploitation attempts spiked from zero to eight within 48 hours of Rapid7’s PoC publication. Prioritize internet-facing assets first, then internal systems.
-
Objective 3 (Secret Tip): Hunt beyond the CVE—look for indicators of compromise specific to each attack chain: Monero miner processes on macOS (
xmrig), forged JWT tokens in SharePoint logs, `reverse_ssh` binaries and cron artifacts (zz-poc59310-syslog.log) on vCenter, and anomalous IKEv2 traffic on UDP 500/4500 for Windows systems.
You Should Know:
- CVE-2026-65400 – macOS Screen Sharing Authentication Bypass (CVSS 9.8)
This improper authentication vulnerability in Apple macOS allows an attacker on the same network to authenticate to Screen Sharing without valid credentials. The Dutch National Cyber Security Centre (NCSC-1L) reported active exploitation as early as August 12, 2026, with attackers gaining root access and installing Monero cryptocurrency miners. The flaw affects macOS Tahoe, Sequoia, and Sonoma releases; Apple fixed it in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Exploitation depends on TCP port 5900 being exposed to the internet.
Step-by-Step Guide – macOS Mitigation:
- Patch immediately: Update to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9.
- Disable Screen Sharing if not required: Navigate to System Settings > General > Sharing and toggle off Screen Sharing.
- Block port 5900 at network perimeter: Use firewall rules to block inbound TCP 5900 from untrusted networks.
- Hunt for Monero miners: Check for unauthorized processes like `xmrig` or unusual CPU usage:
ps aux | grep -i xmrig top -o cpu
- Audit Screen Sharing logs: Review `/var/log/system.log` for unauthorized VNC connection attempts.
-
CVE-2026-55040 – SharePoint JWT Authentication Bypass (CVSS 9.1)
This critical security feature bypass in Microsoft SharePoint stems from weaknesses in the JWT token validation pipeline. An unauthenticated attacker can forge a valid JWT by chaining four distinct flaws: sending a JWT with `”alg: none”` in the outer header (no signature required), using SharePoint’s own STS certificate thumbprint in the `x5t` header, exploiting the absence of certificate verification, and providing a non-empty but unverified signature (e.g., AAAA). Microsoft patched this in July 2026 (KB5002882 for Subscription Edition, build 16.0.19725.20434). Rapid7 released a Python-based PoC on August 12, 2026; within 48 hours, attackers were using it against SharePoint honeypots.
Step-by-Step Guide – SharePoint Mitigation:
- Apply July 2026 Patch Tuesday updates: Install KB5002882 (Subscription Edition), KB5002883, or KB5002891 depending on your deployment.
- If patching is delayed, restrict network access: Limit SharePoint server exposure to trusted networks only.
- Monitor for forged JWT tokens: Audit SharePoint authentication logs for anomalous token validation failures.
- Review Rapid7’s PoC for defensive understanding: Access the GitHub repository at `github.com/sfewer-r7/CVE-2026-55040` to understand the attack chain.
- Hunt for unauthorized user enumeration: Look for suspicious SID enumeration queries targeting domain controllers.
-
CVE-2026-59310 – vCenter Path Traversal to RCE (CVSS 9.8)
This directory traversal vulnerability resides in the VMware vCenter Syslog server component, allowing an unauthenticated attacker with network access to execute arbitrary code. Broadcom released fixes on July 29, 2026, in vCenter 9.1.0.0300, 9.0.2.0100, and 8.0 U3k/U2f. A suspected China-1exus APT began exploiting this flaw just five days after disclosure, compromising 361 systems across 47 countries. The attack chain involves the cron daemon logging a malformed file (zz-poc59310-syslog.log), followed by a `curl` or `wget` command retrieving a backdoor from attacker-controlled infrastructure, and deployment of `reverse_ssh` binaries for persistent outbound access. In at least one case, this led to Babuk-derived ransomware deployment on ESXi hosts, encrypting files with the `.babyk` extension.
Step-by-Step Guide – vCenter Mitigation:
- Patch immediately: Upgrade to vCenter 9.1.0.0300, 9.0.2.0100, or 8.0 U3k/U2f.
- Audit internet-facing vCenter instances: Identify and restrict any vCenter management interfaces exposed to the internet.
- Hunt for reverse_ssh backdoors: Check for outbound SSH connections to unknown IPs and unauthorized cron jobs:
Check for malicious cron files ls -la /etc/cron.d/ | grep -i poc Check for reverse_ssh processes ps aux | grep -i reverse_ssh Review syslog for anomalous log files grep -i "zz-poc59310" /var/log/syslog
- Monitor for Babuk ransomware indicators: Look for files with `.babyk` extension and unauthorized encryption activities on ESXi hosts.
- Block outbound connections to known malicious IPs: Block `5.34.177[.]38:9861` and other C2 infrastructure.
-
CVE-2026-33824 – Windows IKE Double Free RCE (CVSS 9.8)
This critical double-free vulnerability (CWE-415) in the Windows Internet Key Exchange (IKE) Service Extensions (ikeext.dll) allows an unauthenticated, remote attacker to execute code by sending specially crafted packets to UDP ports 500 or 4500. Microsoft patched this in April 2026 Patch Tuesday, but it has since been added to CISA KEV due to active exploitation. Palo Alto Networks Unit 42 observed a Chinese-speaking threat actor exploiting this flaw as part of an AI-enabled autonomous hacking campaign using DeepSeek, alongside manual operations. The actor wired DeepSeek into the Hermes Agent framework, allowing the AI to autonomously scan targets, select exploits, and launch attacks.
Step-by-Step Guide – Windows IKE Mitigation:
- Apply April 2026 security updates: Install the Microsoft patch addressing CVE-2026-33824.
- If patching is delayed, block inbound UDP 500 and 4500: Use Windows Firewall or network perimeter devices:
Block UDP ports 500 and 4500 via Windows Firewall New-1etFirewallRule -DisplayName "Block IKE UDP 500" -Direction Inbound -Protocol UDP -LocalPort 500 -Action Block New-1etFirewallRule -DisplayName "Block IKE UDP 4500" -Direction Inbound -Protocol UDP -LocalPort 4500 -Action Block
- Alternatively, disable IKEEXT service on hosts that do not require IPsec/IKEv2 VPN:
Stop-Service IKEEXT Set-Service IKEEXT -StartupType Disabled
- Restrict IKE ports to trusted peers only if the service must remain available.
- Hunt for exploitation attempts: Monitor for anomalous IKEv2 negotiation packets and unexpected IKEEXT service crashes.
What Undercode Say:
- Key Takeaway 1: The convergence of manual APT exploitation and AI-automated attacks marks a paradigm shift. DeepSeek-powered autonomous hacking is no longer theoretical—it’s operational. Organizations must prepare for attacks that scale exponentially and adapt in real-time.
-
Key Takeaway 2: The speed of weaponization is accelerating. CVE-2026-55040 saw active exploitation within 48 hours of PoC release; CVE-2026-59310 was exploited within five days of disclosure. Patch cycles measured in weeks are now measured in hours.
Analysis: The four CVEs in this advisory represent a cross-platform assault on enterprise infrastructure. macOS endpoints are being recruited into cryptocurrency mining botnets; SharePoint servers are facing authentication bypass that grants administrator-level access; vCenter instances—the crown jewels of virtualized environments—are being backdoored for persistent access and ransomware deployment; and Windows IKE endpoints are being targeted by both manual and AI-driven attackers. The Babuk-derived ransomware deployment on ESXi hosts is particularly concerning, as it encrypts virtual machines at the hypervisor level, bypassing traditional endpoint detection. The China-1exus attribution for vCenter exploitation, based on Chinese-language artifacts, UTC+08:00 activity patterns, and victimology excluding mainland China, underscores the geopolitical dimension of these attacks. Meanwhile, the DeepSeek-powered campaign demonstrates how AI is lowering the barrier to entry for sophisticated attacks, enabling a single actor to simultaneously target multiple vulnerability classes across disparate platforms.
Prediction:
- -1 The speed of AI-automated exploit development will outpace human patching cycles, creating a permanent “zero-day window” where organizations are vulnerable between disclosure and remediation. DeepSeek and similar models will continue to be weaponized, with more threat actors adopting autonomous attack frameworks.
-
-1 Ransomware groups will increasingly target virtualization layers (ESXi, vCenter) rather than individual endpoints, as encrypting entire VMs yields higher ransom demands with less effort. The Babuk-derived payload on vCenter is a harbinger of this trend.
-
+1 CISA’s KEV catalog and BOD 26-04 mandates are forcing federal agencies to adopt faster patching cadences, which will gradually raise the baseline of security across critical infrastructure. Private sector organizations that adopt KEV as their minimum patching standard will reduce their attack surface significantly.
-
-1 The public release of PoC exploits—while valuable for defensive research—is creating a “weaponization window” that attackers are exploiting with increasing speed. The SharePoint flaw’s exploitation within 48 hours of PoC release demonstrates that responsible disclosure timelines are shrinking faster than organizational patch cycles can accommodate.
-
+1 The detailed telemetry from these attacks—including the 361 compromised IPs across 47 countries—provides threat intelligence that can be operationalized for network defense, enabling organizations to block known malicious IPs and hunt for specific IOCs.
FCEB agencies: patch by August 21, 2026. Everyone else: treat this as your deadline too.
▶️ Related Video (76% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: https://lnkd.in/p/e9fnEqGR – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
