Actively Exploited Vulnerabilities Affecting macOS, SharePoint, VMware vCenter and Windows IKE

Risk Rating: CRITICAL
Priority: Immediate Remediation

Executive Summary

Four critical vulnerabilities affecting Apple macOS, Microsoft SharePoint Server, VMware vCenter Server and Microsoft Windows IKE Service Extensions are currently being actively exploited.

The vulnerabilities present different attack paths, ranging from unauthorized remote access and authentication bypass to remote code execution. Of particular concern is the potential impact on enterprise management infrastructure, including SharePoint and VMware vCenter, where successful exploitation could provide attackers with access to sensitive information, privileged systems or the underlying virtualized environment. The vulnerabilities are:

CVE-2026-65400 (CVSS: 9.8 – Critical): An improper authentication vulnerability affecting Apple macOS that could allow an attacker with network access to authenticate to the Screen Sharing service without valid credentials.

CVE-2026-55040 (CVSS: 9.1 – Critical): A weak authentication vulnerability affecting Microsoft SharePoint that could allow an unauthorized attacker to bypass a security feature over a network.

CVE-2026-59310 (CVSS: 9.8 – Critical): A path traversal vulnerability affecting Broadcom VMware vCenter that could allow an attacker with network access to vCenter to execute arbitrary code on the affected system.

CVE-2026-33824 (CVSS: 9.8 – Critical): A double-free vulnerability affecting Microsoft Internet Key Exchange (IKE) Service Extensions that could allow an unauthorized attacker to execute arbitrary code remotely over a network.

Key Risks

• macOS: Attackers may authenticate to Screen Sharing without valid credentials, potentially gaining unauthorized remote access.  

• SharePoint: Authentication bypass could expose corporate documents, applications and sensitive information.  

• vCenter: Remote code execution could allow compromise of virtual infrastructure and multiple hosted workloads. Exploitation has reportedly progressed to persistence and ransomware deployment.  

• Windows IKE: Remote code execution could provide an attacker with an initial foothold on systems supporting VPN/IPsec communications.

Recommended Actions

1. Identify all affected systems and confirm their versions/builds.  

2. Patch immediately using the applicable vendor security updates.  

3. Restrict exposure, particularly for Internet-facing systems and administrative interfaces.  

4. Disable unnecessary services, including Screen Sharing where not required.  

5. Review logs and endpoint telemetry for suspicious authentication, remote access, process execution, SSH activity, configuration changes and other indicators of compromise.  

6. Investigate systems that were vulnerable before patching, as remediation does not rule out prior compromise.

Given the critical severity and active exploitation, these vulnerabilities should be treated as an immediate priority.