CISA Warns of Active Exploitation: Critical RCE and Authentication Bypass Flaws in Microsoft, VMware, and Apple Products + Video

By /

Listen to this Post

Featured Image

Introduction

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive mandating the patching of four actively exploited vulnerabilities affecting Microsoft Windows, SharePoint, VMware vCenter, and Apple macOS. These flaws—ranging from remote code execution (RCE) in the Windows IKE service to an authentication bypass in macOS Screen Sharing—are being weaponized by threat actors with alarming speed, including an AI-enabled Chinese-speaking hacking campaign and a global APT operation that has already compromised over 360 VMware vCenter instances across 47 countries. With CISA’s Binding Operational Directive (BOD) 26-04 requiring federal agencies to patch by August 21, 2026, organizations must treat these vulnerabilities as immediate, critical threats to their infrastructure.

Learning Objectives & Secrets

  • Objective 1: Understand the Technical Root Causes – Grasp the underlying memory corruption, JWT validation logic flaws, path traversal, and state-machine authentication bypasses that make these vulnerabilities so dangerous. Knowing why they work is the first step to effective defense.

  • Objective 2 (Secret Tip): Prioritize Patching Based on Exploit Velocity – The exploitation window for these vulnerabilities is shrinking rapidly. CVE-2026-59310 (VMware vCenter) was exploited just five days after disclosure. CVE-2026-55040 (SharePoint) saw active exploitation within 24 hours of its PoC release. Secret: Don’t wait for your regular patch cycle—treat these as zero-day equivalents and apply emergency out-of-band patches immediately.

  • Objective 3 (Secret Tip): Hunt for Persistence Mechanisms Beyond the Patch – Attackers are deploying reverse SSH backdoors (CVE-2026-59310), Monero miners (CVE-2026-65400), and obfuscated ROP chains (CVE-2026-33824). Secret: After patching, conduct forensic hunts for unauthorized SSH keys, LaunchDaemons, and unusual outbound connections—the patch removes the entry point, but the backdoor may already be installed.

You Should Know

  1. CVE-2026-33824: Windows IKE Service Double-Free RCE (CVSS 9.8)

This critical vulnerability resides in ikeext.dll, the Windows IKEv2 driver, and stems from improper ownership handling of a heap-allocated blob pointer during IKEv2 fragment reassembly. During the IKE_SA_INIT exchange, a Security Realm Vendor ID payload triggers `IkeHandleSecurityRealmVendorId()` to allocate a blob and store it in the MMSA structure. When a fragmented IKE_AUTH message is reassembled, `IkeReinjectReassembledPacket` copies the blob pointer into a local stack struct, which is then shallow-copied into a heap-allocated work item. The result: the same pointer is freed twice, enabling remote, unauthenticated attackers to execute arbitrary code via specially crafted IKE packets.

Step-by-step guide to verify and mitigate:

  1. Identify vulnerable systems: All supported Windows versions with the IKE service enabled are affected. Check if the IKEEXT service is running:

– Windows (CMD as Admin): `sc query IKEEXT | find “STATE”`
– PowerShell: `Get-Service -1ame IKEEXT | Select-Object Name, Status`

2. Verify patch status: Microsoft released the fix in April 2026. Check installed updates:
– PowerShell: `Get-HotFix | Where-Object {$_.InstalledOn -ge “2026-04-01”} | Select-Object HotFixID, InstalledOn`
– Review the specific KB update associated with your Windows version.

3. Network-level mitigation (if patching is delayed):

  • Block IKE traffic (UDP port 500 and UDP port 4500) at the perimeter firewall unless absolutely required.
  • Windows Firewall (Admin): `New-1etFirewallRule -DisplayName “Block IKE” -Direction Inbound -Protocol UDP -LocalPort 500,4500 -Action Block`
  1. Apply the update immediately: Download and install the April 2026 cumulative update for your Windows version. There is no workaround—patching is the only remediation.

  2. Post-patch verification: After applying the update, confirm the IKEEXT service is stable and no crash logs are present:

– Event Viewer: Navigate to Windows Logs → System and filter for Event ID 1000 (application crashes) with source “IKEEXT”.

2. CVE-2026-55040: SharePoint JWT Authentication Bypass (CVSS 9.1)

This flaw chains four distinct weaknesses in SharePoint’s JWT token validation pipeline, allowing an unauthenticated attacker to forge a valid token and impersonate any SharePoint user—up to site administrator. The chain works as follows: SharePoint disables outer-token signature checks (RequireSignedTokens is false, so `alg: none` is accepted); it resolves the inner actor token’s signing key from an attacker-supplied `x5t` thumbprint without verifying the signature; issuer validation accepts SharePoint’s own STS certificate because it is not in the trusted-services list; and the final check only requires a non-empty signature value. The attacker first reads the STS signing certificate from the unauthenticated `/_layouts/15/metadata/json/1` endpoint, then forges a JWT with `alg: none` and the actor token’s `x5t` set to that certificate’s thumbprint.

Step-by-step guide to verify and mitigate:

  1. Identify all SharePoint instances: Run the following PowerShell script to find SharePoint servers in your environment: 
    Get-SPServer | Select-Object Address, Role

2. Check for vulnerable versions:

  • SharePoint Server Subscription Edition: Fixed in KB5002882 (build 16.0.19725.20434)
  • SharePoint Server 2019: Fixed in KB5002883 (build 16.0.10417.20175)
  • SharePoint Server 2016: Fixed in KB5002891 (build 16.0.5561.1001)

3. Test for the vulnerability (ethical use only):

  • Rapid7’s Python-based PoC uses the forged JWT token to query a target’s domain controller, enumerate users by SID, and auto-locate the site administrator SID.
  • Security warning: Do not run this against production systems without explicit authorization.
  1. Apply the July 2026 Patch Tuesday updates immediately. There is no workaround for this flaw.

5. Monitor for exploitation attempts:

  • Check IIS logs for unusual requests to /_layouts/15/metadata/json/1—this endpoint is used to harvest the STS certificate thumbprint.
  • PowerShell (parse IIS logs): `Get-Content “C:\inetpub\logs\LogFiles\W3SVC\.log” | Select-String “/_layouts/15/metadata/json/1″`
    – Review SharePoint audit logs for anomalous authentication events from unusual IP addresses.
  1. CVE-2026-59310: VMware vCenter Syslog Directory Traversal RCE (CVSS 9.8)

This is a directory-traversal vulnerability in the VMware vCenter Syslog server that allows an unauthenticated attacker with network access to execute arbitrary code on the vCenter appliance. Broadcom rated it Critical with a maximum CVSS score of 9.8, and there is no workaround—patching is the only remediation. The vulnerability was disclosed on July 29, 2026, and exploitation began just five days later on August 3. Security firm QUIRSO has identified 361 victim IP addresses across 47 countries, with Germany, the United States, Turkey, Iran, and France being the most heavily impacted. Following initial compromise, attackers deploy the open-source `reverse_ssh` tool to maintain an outbound control channel that bypasses inbound network controls.

Step-by-step guide to verify and mitigate:

1. Identify vulnerable vCenter versions:

  • vCenter 9.1.x: Fixed in 9.1.0.0300
  • vCenter 9.0.x: Fixed in 9.0.2.0100
  • vCenter 8.0: Fixed in 8.0 U3k or 8.0 U2f

2. Check your current version:

  • vCenter Appliance (Shell): `vpxd -v`
    – Web interface: Navigate to vCenter → Help → About VMware vCenter
  1. Apply VMSA-2026-0006.1 immediately. This update also fixes a paired authentication-bypass flaw, CVE-2026-59309, in the VMware Directory Service.

4. Hunt for reverse_ssh persistence (even after patching):

  • Check for unauthorized outbound SSH connections:
  • Linux/vCenter Shell: `ss -tunap | grep ESTABLISHED | grep :22`
    – Look for the `reverse_ssh` binary—QUIRSO has released a generic YARA rule for identifying reverse_ssh builds.
  • Find command: `find / -1ame “reverse_ssh” -type f 2>/dev/null`
    – Review system logs for unusual cron jobs or startup scripts.
  1. Network segmentation: If patching is delayed, restrict network access to vCenter to only trusted management networks. The vulnerability requires network access to vCenter, so limiting exposure significantly reduces risk.

  2. CVE-2026-65400: macOS Screen Sharing Authentication Bypass (CVSS 9.8—rescaled from 7.5)

This vulnerability affects screensharingd, the daemon behind macOS Screen Sharing / Apple Remote Management on TCP port 5900. The daemon’s native authentication path uses SRP (Secure Remote Password), but a frame-length validator returns a stale success status, marking the connection as authenticated before any credential has been proven. Apple’s advisory language—”improved state management”—confirms that the cryptography was never broken; the state machine around it was. Once past this gate, the session continues in cleartext, and privileged file-copy helpers (SSFileCopySender/SSFileCopyReceiver) with Full Disk Access can be abused for pre-auth arbitrary file read and write as root. In-the-wild exploitation has been observed with attackers dropping SSH public keys for persistence, clearing logs and shell history, and deploying the XMRig Monero miner.

Step-by-step guide to verify and mitigate:

  1. Identify vulnerable macOS versions (Screen Sharing must be enabled):

– macOS Tahoe 26: ≤ 26.6 → Fixed in 26.6.1
– macOS Sequoia 15: ≤ 15.7.8 → Fixed in 15.7.9
– macOS Sonoma 14: ≤ 14.8.8 → Fixed in 14.8.9

2. Check if Screen Sharing is enabled:

  • Terminal: `sudo systemsetup -getremotelogin` (for Remote Login) and check System Settings → General → Sharing → Screen Sharing.
  • Check listening port: `sudo lsof -i :5900`
  1. Apply the August 6, 2026 security update immediately.

4. Disable Screen Sharing if not required:

  • Terminal: `sudo systemsetup -setremotelogin off`
    – This is the most effective mitigation if the service is not essential.

5. Hunt for compromise (even after patching):

  • Check for unauthorized SSH keys:
  • Terminal: `cat /Users//.ssh/authorized_keys` (look for unfamiliar keys)
  • Review LaunchDaemons for suspicious entries:
  • Terminal: `ls -la /Library/LaunchDaemons/ | grep -v com.apple`
    – Check for the XMRig miner:
  • Terminal: `ps aux | grep -i xmrig`
    – Review system logs for cleared history:
  • Terminal: `cat /Users//.bash_history | tail -20` (look for gaps or `history -c` commands)

What Undercode Say

  • Key Takeaway 1: The Exploitation Window Is Shrinking Dramatically – The gap between patch disclosure and active exploitation has narrowed to mere days—five days for VMware vCenter, less than 24 hours for SharePoint post-PoC. This acceleration, driven by AI-assisted reverse engineering and automated PoC generation, means organizations can no longer rely on traditional 30-day patch cycles. The era of “patch Tuesday, exploit Wednesday” is now “patch Tuesday, exploit Tuesday.”

  • Key Takeaway 2: AI Is Democratizing Exploit Development – The CVE-2026-33824 campaign, attributed to a Chinese-speaking threat actor, used DeepSeek and Hermes Agent to autonomously attack over 460 internet-facing systems. This represents a paradigm shift: AI agents can now perform reconnaissance, vulnerability matching, and even rudimentary exploitation without human intervention. Defenders must similarly adopt AI-driven threat hunting and automated patch management to keep pace.

Analysis: The convergence of four critical vulnerabilities across the entire enterprise stack—from endpoint (Windows, macOS) to collaboration (SharePoint) to infrastructure (vCenter)—signals a coordinated, multi-vector assault on enterprise IT. What’s particularly alarming is the sophistication of the attack chains: the Windows IKE vulnerability involves heap grooming, ROP chains, and anti-debugging obfuscation; the SharePoint flaw chains four distinct logic errors; and the macOS bug exploits a state-machine flaw rather than a cryptographic weakness. This is not script-kiddie activity—these are advanced, well-resourced threat actors leveraging every tool in the modern attacker’s arsenal, including AI. Defenders must respond with equal sophistication: automated vulnerability scanning, continuous patch compliance monitoring, and proactive threat hunting for persistence mechanisms. The CISA KEV catalog is no longer a “nice to have” reference—it is a binding operational directive that demands immediate, prioritized action.

Prediction

  • -1 Expect a surge in ransomware and data extortion campaigns targeting unpatched SharePoint servers over the next 30–60 days. The SharePoint JWT bypass (CVE-2026-55040) provides authenticated access with minimal effort, making it an ideal entry point for data exfiltration and ransomware deployment.

  • -1 The VMware vCenter flaw (CVE-2026-59310) will continue to be exploited by APT groups for persistent backdoor access. The deployment of reverse_ssh—which bypasses inbound firewall controls—means that simply patching the vulnerability will not evict attackers who have already established footholds. Organizations must conduct thorough forensic investigations alongside patching.

  • +1 The widespread adoption of AI in both offensive and defensive security will accelerate the development of automated patch management and vulnerability detection tools. Expect to see AI-powered CISA KEV monitoring and automated patching solutions become standard enterprise security controls within the next 12–18 months.

  • -1 The macOS Screen Sharing flaw (CVE-2026-65400) will be weaponized for supply chain attacks against macOS developers and enterprises. With the ability to read and write arbitrary files as root, attackers can inject malicious code into development environments, CI/CD pipelines, and software builds. Organizations with macOS-based development teams should treat this as an urgent supply chain risk.

  • +1 The CISA KEV catalog will become the de facto standard for enterprise patch prioritization, with cyber insurance providers and regulatory bodies mandating compliance with KEV timelines. Organizations that fail to patch KEV-listed vulnerabilities within the specified windows may face increased premiums or loss of coverage.

▶️ Related Video (74% Match):

https://www.youtube.com/watch?v=2ixZnjjTkqE

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: https://lnkd.in/p/e4ftNtJz – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: