cyberresearch.us

TLP:CLEAR confidence:medium · #cyber-news #critical

Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation

Luke Johnson / Cyber Research US

Summary

Public reporting (Segu-Info summarizing The Hacker News; heise title-level coverage) says CISA added four already-patched, high-severity bugs to the Known Exploited Vulnerabilities catalog because they are under active exploitation: Apple macOS Screen Sharing auth failure, Microsoft SharePoint weak authentication, Broadcom VMware vCenter path traversal RCE, and a Microsoft IKE Extensions double-free RCE. This memo is a synthesis of that secondary coverage only; it is not independent reverse engineering or lab confirmation. Exploitation is claimed for all four, with different operators and outcomes per product.

Attack vector

All four are described as reachable over the network with no extra client-side lure stated:

  • macOS (CVE-2026-65400): An on-network attacker targets Apple Screen Sharing (Compartir Pantalla) and authenticates to that service without valid credentials (Segu-Info).
  • SharePoint (CVE-2026-55040): An unauthorized remote attacker reaches Microsoft SharePoint over the network and bypasses a security control (Segu-Info). No URL, endpoint, or auth protocol is named.
  • vCenter (CVE-2026-59310): Attacker needs network access to VMware vCenter; path traversal is then used toward arbitrary code execution (Segu-Info). Privilege level beyond network reachability is not specified.
  • Microsoft IKE (CVE-2026-33824): Unauthorized attacker sends traffic to Microsoft Internet Key Exchange Service Extensions and achieves code execution over the network (Segu-Info). Port/IKE mode is not stated.

Exploit

Bug classes as reported, not reconstructed:

  • CVE-2026-65400: Incorrect authentication — Screen Sharing accepts the attacker without valid credentials (CVSS 9.8).
  • CVE-2026-55040: Weak authentication — security-measure bypass over the network (CVSS 9.1). Unknown actors used a published proof-of-concept after disclosure (Segu-Info). PoC contents are not in these articles.
  • CVE-2026-59310: Path traversal on vCenter leading to arbitrary code execution (CVSS 9.8). Post-exploit (not the bug itself): alleged China-linked APT deploys a backdoor plus reverse_ssh binaries; at least one case progressed to Babuk-derived ransomware (Segu-Info).
  • CVE-2026-33824: Double-free of keys in Microsoft IKE Service Extensions, unauthorized RCE (CVSS 9.8). Palo Alto Networks Unit 42 (via Segu-Info) attributes exploitation to a Chinese-speaking actor that also ran an autonomous AI-assisted campaign (DeepSeek) plus manual ops on known bugs including this IKE issue. No packet layout or free/reuse steps are given.

In the wild / novelty

CISA KEV addition is the common “known exploited” signal (Segu-Info; heise warning headline). Distinguish:

  • Disclosure/patch: Vendors have already shipped fixes; exploitation continues (Segu-Info).
  • macOS: Used to distribute a Monero miner (Segu-Info). Not described as APT.
  • SharePoint: Exploitation by unknown actors after public PoC — disclosure/PoC preceded reported abuse.
  • vCenter: Claimed China-linked APT; 361 unique victim IPs in 47 countries, heaviest in Germany (55), United States (41), Turkey (38), Iran (26), France (25); some ransomware follow-on (Segu-Info). Victim-IP methodology (scan vs confirmed compromise) is not defined here.
  • IKE: Unit 42 detection of a separate Chinese-speaking actor (Segu-Info). No honeypot operator is named. No first-party CISA bulletin text is in the cluster.

Risk

Successful abuse yields unauthenticated or weakly authenticated remote access or RCE on high-value surfaces: macOS Screen Sharing sessions, SharePoint (document/identity store), vCenter (hypervisor control plane), and Windows IKE/VPN-adjacent services. vCenter compromise is the largest blast radius in the reporting — persistent backdoor, reverse SSH, and at least one Babuk-family ransomware path across hundreds of IPs. SharePoint bypass risks tenant data and further lateral movement; IKE RCE risks perimeter/VPN hosts; macOS Screen Sharing abuse risks interactive remote control and miner payload.

Remediation

Sources only state that the respective vendors have already patched and that CISA listed the four CVEs in KEV (federal KEV due-date process implied, not quoted). Grounded actions:

  • Apply current Apple, Microsoft SharePoint, Broadcom/VMware vCenter, and Microsoft IKE/Windows updates covering CVE-2026-65400, CVE-2026-55040, CVE-2026-59310, and CVE-2026-33824.
  • Restrict network exposure of Screen Sharing, SharePoint, vCenter management, and IKE/VPN endpoints to trusted networks; treat internet-facing instances as emergency patch/hunt.
  • Hunt vCenter for unexpected backdoors and reverse_ssh binaries and for Babuk-derived ransomware; hunt macOS for Monero miner follow-on; treat SharePoint as PoC-driven mass scanning after public exploit code.
  • Validate by confirming KEV CVE IDs absent from unpatched inventory and by reviewing auth/RCE-related logs on those four services. No IOCs, YARA, or patch KB numbers appear in these articles.

CVE / identifiers

CVE-2026-65400 (macOS Screen Sharing, incorrect auth, CVSS 9.8); CVE-2026-55040 (SharePoint, weak auth, CVSS 9.1); CVE-2026-59310 (vCenter path traversal RCE, CVSS 9.8); CVE-2026-33824 (Microsoft IKE Extensions key double-free RCE, CVSS 9.8). CISA KEV. CWE IDs not stated.

Confidence

medium — CVE IDs, CVSS, product, and bug class agree across Segu-Info (citing THN) and the heise headline, and Unit 42 is named for IKE. Primary THN and heise bodies in this cluster are truncated; exploit mechanics, versions, and IOCs are thin; campaign stats are single-source.

Open questions

Affected product versions, exact Screen Sharing / SharePoint / IKE protocols and ports, vCenter path and whether auth is required, SharePoint PoC author and bypass primitive, miner and backdoor families/hashes, Unit 42 report title, whether 361 IPs are confirmed compromises, and any conflict between “China-linked APT” (vCenter) vs “another Chinese-speaking actor” (IKE) remain unspecified or uncorroborated in the fetched text.

Sources