CISA Orders Emergency Patching of Four Critical Flaws Including Microsoft IKE, SharePoint, VMware, and macOS by August 21 (CVE-2026-33824 and Others)

Scope: Microsoft IKE Service Extensions, Microsoft SharePoint Server, VMware vCenter, Apple macOS (All Supported Versions)

Severity: Red

CISA added four critical vulnerabilities to its Known Exploited Vulnerabilities catalog on August 19, 2026, requiring all Federal Civilian Executive Branch agencies to patch by August 21, 2026 under BOD 26-04. The most significant new addition is CVE-2026-33824 (CVSS 9.8), a double-free vulnerability in Microsoft Internet Key Exchange Service Extensions that allows unauthenticated network-accessible attackers to execute arbitrary code on affected Windows servers, with Palo Alto Networks Unit 42 attributing active exploitation to a Chinese-speaking threat actor simultaneously running AI-enabled autonomous hacking using DeepSeek alongside manual operations. The other three additions cover the Apple macOS Screen Sharing crypto miner exploitation (CVE-2026-65400), the SharePoint authentication bypass (CVE-2026-55040), and VMware vCenter directory traversal (CVE-2026-59310), all of which have been covered in prior CERT.UG/CC advisories this week. Organizations must apply all four patches immediately and treat any system that was internet-exposed before patching as potentially compromised.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.