CISA gave federal agencies three days to patch four exploited flaws

CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on 18 August 2026, covering Microsoft IKE, Microsoft SharePoint, Broadcom VMware vCenter and Apple macOS.

The detail that did not make the headlines is the clock. The federal remediation deadline is 21 August 2026, three days after the catalog entry. Under BOD 22-01, CISA normally sets KEV due dates around three weeks out. Three days is the exception, and it is the single most informative thing in this batch. That deadline is tomorrow.

The four entries

Every one of these already has a patch. Nothing here is a zero-day awaiting a fix. The oldest, the IKE double free, was patched in April 2026, which means the exploited population has had roughly four months to install it and has not. That is the real finding: this is a patch-deployment failure, not a disclosure event.

What each one actually does

CVE-2026-33824, Microsoft IKE Service Extensions. A double free that lets a remote, unauthenticated attacker execute arbitrary code via specially crafted packets. Exploitation is attributed to a Chinese-speaking threat actor running an AI-assisted campaign, with Palo Alto Networks describing largely autonomous operation using DeepSeek alongside manual work. Patched April 2026.

CVE-2026-55040, Microsoft SharePoint. CISA files this as weak authentication. Microsoft's framing is a security-feature bypass over a network by an unauthorized attacker. It is not remote code execution on its own. Exploitation began after public proof-of-concept code appeared in early August 2026, which is the ordinary sequence: patch in July, PoC in August, exploitation immediately after.

CVE-2026-59310, Broadcom VMware vCenter. CISA catalogs it as path traversal, and that is the mechanism, not the outcome. The practical impact is that an attacker with network access to vCenter can execute arbitrary code. Reporting describes a suspected China-nexus group deploying backdoors, reverse_ssh binaries and Babuk-derived ransomware, with 361 victim IPs across 47 countries. Patched 29 July 2026.

CVE-2026-65400, Apple macOS. Improper authentication in Screen Sharing, letting an attacker on the network authenticate without valid credentials. Observed exploitation has been unglamorous: dropping a Monero cryptocurrency miner. Patched 6 August 2026.

One score is in dispute

The macOS entry does not have an agreed severity. The Hacker News puts CVE-2026-65400 at CVSS 9.8. SecurityWeek puts it at 7.5.

That is the difference between critical and high, and it changes where the ticket sits in most patching queues. The gap is explainable: a network authentication bypass scores very differently depending on whether the assessor treats the result as full system compromise or as unauthorized access to a single service. CISA's own catalog entries do not carry CVSS scores, so there is no tiebreaker in the primary source. If your process routes by severity, note that this one is contested and route it on the exploitation evidence instead, which is not in dispute.

Who has to act, and who merely should

Federal Civilian Executive Branch agencies are bound by BOD 22-01, which requires them to remediate catalogued vulnerabilities by the due date. For these four, that is 21 August 2026.

Everyone else has no legal obligation and the same exposure. CISA's standing position is that private organizations should review the catalog and address these vulnerabilities in their own infrastructure. The KEV catalog is not a severity list, it is an evidence-of-exploitation list, which makes it a better patching queue than CVSS for most teams.

You can skip this batch only if you can show you already deployed the April 2026 Windows updates, the July 2026 SharePoint updates, the 29 July vCenter fix and the 6 August macOS update. Deployed, not downloaded.

The takeaway

Check four things today, in this order, because it maps to how these are actually being exploited: internet-reachable vCenter first, since that is the one with ransomware and 361 confirmed victim IPs behind it. Then Windows hosts running IKE, where a four-month-old patch is being exploited by an automated campaign. Then SharePoint, where public exploit code is circulating. Then macOS Screen Sharing, which is the lowest stakes and the easiest to close by turning the service off where it is not needed. If you are a federal agency, that work is due tomorrow. If you are not, the attackers do not know the difference.