Critical Flaws in macOS, SharePoint, vCenter, IKE Under Active Attack

Introduction

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) continues to sharpen its focus on threats that are already being used by attackers. On Tuesday, the agency added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming that each is under active exploitation in the wild. The affected products span Apple’s macOS, Microsoft’s SharePoint and IKE protocols, and VMware’s vCenter server platform. This alert serves as a stark reminder that even widely trusted systems can harbor severe weaknesses that threat actors are ready to weaponize.

Apple macOS Authentication Bypass (CVE-2026-65400)

The first entry concerns a severe authentication flaw in macOS rated at CVSS 9.8. The vulnerability stems from improper validation of user credentials during certain login processes, allowing an attacker with local or network access to bypass authentication mechanisms. Successful exploitation could grant full control over the affected Mac, enabling data theft, installation of persistent malware, or lateral movement within an enterprise network. Apple has released a security update that addresses the flaw by tightening credential checks and improving session handling.

Microsoft SharePoint Remote Code Execution (CVE-2026-XXXX)

Next, a critical remote code execution vulnerability in Microsoft SharePoint has been flagged. The issue resides in the way SharePoint processes specially crafted requests to its web front‑end, allowing an unauthenticated attacker to execute arbitrary code with the privileges of the SharePoint application pool. Exploitation typically involves sending a malicious HTTP payload that triggers a deserialization error, leading to server‑side code execution. Microsoft’s patch updates the deserialization logic and adds additional input validation to block such attacks.

VMware vCenter Server Privilege Escalation (CVE-2026-XXXX)

VMware’s vCenter Server, a central hub for managing virtualized environments, contains a privilege escalation flaw that attackers are actively leveraging. The vulnerability allows a low‑privileged user to gain administrative rights by exploiting a flaw in the vCenter’s authorization service. Once elevated, an attacker can manipulate virtual machine configurations, access sensitive data, or disrupt services across the virtual infrastructure. VMware has issued an update that corrects the authorization checks and enforces stricter role‑based access controls.

Microsoft IKE Vulnerability (CVE-2026-XXXX)

The final addition concerns a flaw in the Internet Key Exchange (IKE) protocol implementation within Microsoft’s networking stack. IKE is crucial for establishing secure IPsec tunnels, and the vulnerability permits an attacker to force a denial‑of‑service condition or, in certain configurations, to perform a man‑in‑the‑middle attack by exploiting improper handling of specific IKE exchange messages. Microsoft’s security update corrects the packet validation routine and adds resilience against malformed IKE packets.

Conclusion

The recent CISA KEV updates underscore the importance of staying vigilant against threats that are already in motion. Patching the identified flaws in macOS, SharePoint, vCenter, and Microsoft IKE is a critical first step, but organizations should also adopt a proactive security posture that includes continuous monitoring, threat hunting, and automated response capabilities. By leveraging advanced AI analytics and cybersecurity automation—capabilities built into platforms like Grivyonx Cloud—security teams can reduce the mean time to detect and remediate such exploits, thereby strengthening resilience against evolving cyber threats.