Advisory · 18 Aug 2026 · 6 min
Four KEVs in one day: patch SharePoint and vCenter before the rest
CISA added four exploited CVEs on 18 August 2026. For most estates the consequence order is SharePoint, vCenter, IKE/VPN, then macOS endpoints.
On 18 August 2026 CISA added four vulnerabilities to the Known Exploited Vulnerabilities catalog: CVE-2026-33824 (Microsoft IKE Service Extensions, double free), CVE-2026-55040 (Microsoft SharePoint, weak authentication), CVE-2026-59310 (Broadcom VMware vCenter, path traversal), and CVE-2026-65400 (Apple macOS, improper authentication).
Federal agencies have a short BOD 26-04 window. Everyone else should still treat internet-facing SharePoint and vCenter as this week's work. Those two convert into total control of collaboration and virtualization — the blast radius is not theoretical.
Hunt before you patch. CISA's own guidance is that agencies must check whether actors were already in. That is the right order for a hospital, a ministry, or a 120-person professional-services firm: evidence of access, then the update, then verification.
If you cannot patch this week, isolate. Take SharePoint off the open internet, put vCenter behind a jump path with MFA, and treat VPN/IKE appliances as untrusted until the IKE CVE is closed. Compensating controls are allowed. Silence is not.
CyberSafe will keep this briefing aligned to the public CISA alert. We do not invent extra CVEs for drama. If you need a scoped hunt or a containment retainer, start at Contact and say you are in an exposure window — not a sales cycle.