Windows IKE CVE-2026-33824 Added to CISA KEV

Windows IKE CVE-2026-33824 is now in CISA’s Known Exploited Vulnerabilities catalog, giving defenders a short deadline to verify patching and exposure. CISA added the Windows IKE flaw and three other exploited vulnerabilities to KEV on August 18, 2026, with a remediation due date of August 21, 2026 for covered federal systems. The vulnerabilities affect Microsoft Windows IKE, Microsoft SharePoint, Broadcom VMware vCenter, and Apple macOS Screen Sharing.

Which Vulnerabilities Did CISA Add to KEV?

CISA’s latest KEV additions span remote code execution (RCE), authentication bypass, security feature bypass, and arbitrary code execution risks. All four have the same August 21, 2026 remediation due date.

What Is CVE-2026-33824?

CVE-2026-33824 (CVSS 9.8) is a double-free vulnerability in Microsoft Windows Internet Key Exchange (IKE) Service Extensions. Microsoft describes the issue as allowing an unauthorized attacker to execute code over a network.

The vulnerable Windows IKE component is tied to IKE/IPsec functionality. That makes reachability the main risk factor. Systems that support VPN, IPsec, or related security functions should be reviewed first, especially where IKEv2 traffic is exposed to untrusted networks.

Microsoft patched CVE-2026-33824 during the April 2026 Patch Tuesday release. For broader context on that update cycle, see SOCRadar’s April 2026 Patch Tuesday analysis.

Why Does Windows IKE Exposure Matter?

Windows IKE exposure matters because exploitation does not require valid credentials or user interaction according to the CVSS vector. An exposed host with vulnerable IKE/IPsec functionality may present a remotely reachable attack surface even if it is not running a traditional public web application.

Security teams should prioritize systems where IKEv2 is enabled and reachable, especially where UDP ports 500 and 4500 are exposed to the public internet or broad internal segments. Patch validation should include exact Windows build checks, not only operating system names.

For Windows IKE CVE-2026-33824, practical response should combine patching with exposure reduction. If IKE/IPsec services are not required, restrict or disable them. If they are required, limit access to trusted peer addresses and monitor unusual IKE negotiation attempts.

What Is CVE-2026-55040?

CVE-2026-55040 (CVSS 9.1) is a weak-authentication vulnerability in Microsoft Office SharePoint. Microsoft describes it as allowing an unauthorized attacker to bypass a security feature over a network.

The issue affects on-premises SharePoint environments and should be prioritized where SharePoint is exposed externally or only partially patched. SharePoint commonly stores business documents, collaboration data, and sensitive internal workflows, so a security feature bypass can create meaningful data and access risk.

Microsoft patched CVE-2026-55040 during the July 2026 Patch Tuesday release. SOCRadar’s July 2026 Patch Tuesday analysis provides broader context on that SharePoint-heavy update cycle.

NVD also references public exploit material for CVE-2026-55040, so exposed SharePoint farms should be treated as possible compromise candidates if patching lagged behind disclosure.

What Is CVE-2026-59310?

CVE-2026-59310 is a directory traversal vulnerability in the VMware vCenter Syslog server. Broadcom says a malicious actor with network access to vCenter may exploit the issue to execute arbitrary code, and rates it Critical with a CVSS 3.1 score of 9.8.

Broadcom addressed the vulnerability as part of VMSA-2026-0006, which covers several VMware ESX, vCenter, Workstation, Fusion, Cloud Foundation, vSphere Foundation, and Telco Cloud vulnerabilities. For CVE-2026-59310, Broadcom lists no workaround and directs customers to apply the fixed versions in its response matrix.

Fixed vCenter versions include 8.0 U3k, 8.0 U2f, 9.0.2.0100, and 9.1.0.0300, depending on the deployed branch and platform context. VMware Cloud Foundation and Telco Cloud environments should follow Broadcom’s branch-specific remediation guidance.

What Is CVE-2026-65400?

CVE-2026-65400 is an improper-authentication vulnerability in Apple macOS Screen Sharing. Apple’s CVE record says a network attacker may authenticate to Screen Sharing without valid credentials, and that Apple addressed the issue with improved state management.

Apple fixed the issue in:

NVD’s CISA ADP data lists CVE-2026-65400 as Critical, CVSS 9.8, and places it in CISA KEV with the same August 21, 2026 due date.

The highest-risk systems are Macs with Screen Sharing enabled and reachable from untrusted networks. Organizations should update affected macOS systems, restrict Screen Sharing to trusted networks, or disable it where it is not required.

What Should Security Teams Do Now?

1. Patch Windows IKE CVE-2026-33824 Where Exposed

Prioritize CVE-2026-33824 on Windows systems with reachable IKE/IPsec services. Confirm that the April 2026 Microsoft update was applied and that affected systems reached the required fixed build. Review firewall and VPN telemetry for unusual IKE negotiation attempts, scanning, or suspicious traffic to UDP ports 500 and 4500.

2. Patch SharePoint CVE-2026-55040 Across the Farm

Install the July 2026 SharePoint updates and verify the resulting build across every server in the SharePoint farm. Review authentication anomalies, unexpected access to sensitive files, suspicious token behavior, and administrative activity on exposed or previously unpatched farms.

3. Update vCenter and Restrict Management Access

Patch vCenter according to Broadcom’s VMSA-2026-0006 response matrix. Restrict vCenter management access to dedicated administrative networks, review Syslog server exposure, and investigate unexpected file changes, unusual authentication activity, new processes, or outbound connections from vCenter systems.

4. Patch macOS and Review Screen Sharing Exposure

Update macOS Tahoe, Sequoia, and Sonoma systems to the fixed versions. Disable Screen Sharing where it is not required, and restrict access to trusted networks where it remains in use. Review remote-access logs for unexpected Screen Sharing sessions or authentication events.

5. Hunt Before Declaring Recovery

For exposed systems, patching should be followed by compromise assessment. Review logs for unusual IKE traffic, SharePoint authentication anomalies, unexpected vCenter activity, and suspicious Screen Sharing sessions. Treat unexplained administrative activity, new persistence, unusual process execution, or unexpected outbound traffic as escalation signals.

How Can SOCRadar Help Prioritize Response?

SOCRadar’s Cyber Threat Intelligence helps teams track KEV additions, exploit alerts, affected technologies, and advisory changes around vulnerabilities such as Windows IKE CVE-2026-33824, CVE-2026-55040, CVE-2026-59310, and CVE-2026-65400. It can also alert teams to new critical vulnerabilities or exploits affecting public-facing services and technologies.

SOCRadar’s Attack Surface Management (ASM) adds exposure context by helping organizations identify internet-facing assets, vulnerable software, exposed services, DNS records, certificates, and undiscovered cloud assets. It can also alert when a critical vulnerability is cross-referenced with exposed software assets.

For these CISA KEV additions, combining vulnerability intelligence with exposure visibility helps teams prioritize systems most likely to face real operational risk: exposed IKE endpoints, SharePoint farms, vCenter servers, and macOS systems with reachable Screen Sharing.