The US Cybersecurity and Infrastructure Security Agency (CISA) on August 19 urged immediate patching of four actively exploited vulnerabilities in Microsoft, VMware, and Apple products, adding all four to its Known Exploited Vulnerabilities (KEV) catalog.
The most severe flaw is CVE-2026-33824, a double-free vulnerability in the Windows Internet Key Exchange (IKE) Service Extension carrying a CVSS score of 9.8. It allows remote, unauthenticated attackers to execute arbitrary code via specially crafted network packets. Palo Alto Networks’ Unit 42 flagged in late July that the bug was being exploited by a Chinese-speaking threat actor as part of an AI-enabled autonomous hacking campaign that combined automated scanning with manual exploitation techniques.
Four Flaws Across Multiple Vendors
The second Microsoft vulnerability, CVE-2026-55040 (CVSS 9.1), is an authentication bypass in SharePoint patched in July. Threat actors began targeting it after a proof-of-concept exploit was published earlier this month, according to SecurityWeek. The flaw allows attackers to bypass authentication controls and access protected resources without valid credentials.
VMware vCenter CVE-2026-59310 (CVSS 9.8) is a critical flaw patched on July 29. By August 3, attackers were exploiting it to deploy open-source SSH reverse shells on compromised virtualization servers. Apple’s CVE-2026-65400 (CVSS 7.5) affects macOS Screen Sharing and allows attackers to bypass authentication entirely, gaining root access to deploy cryptocurrency miners on vulnerable devices.
Chinese AI Campaign Signals a Shift in State-Linked Operations
The Chinese AI-enabled campaign targeting the Windows IKE flaw represents a notable shift in how state-linked cyber operators conduct attacks. Rather than relying on teams of human analysts to identify and exploit targets, the attackers deployed automated tools to scan for and exploit the vulnerability at scale, combining AI-generated payloads with hands-on-keyboard techniques for lateral movement.
The approach mirrors broader trends in the threat landscape. Check Point Research reported that organizations experienced an average of 2,336 weekly cyberattacks during July 2026, a 16% increase year-on-year, with ransomware incidents doubling compared to the same period last year. Security firms have warned that AI is lowering the barrier for both criminal and state-sponsored actors to run high-volume exploitation campaigns.
Federal Agencies Given August 21 Deadline
CISA has directed all federal agencies to remediate the four flaws by August 21 in accordance with Binding Operational Directive 26-04. The tight deadline signals the severity of the risk, particularly given the confirmed active exploitation of the Windows IKE and VMware vCenter vulnerabilities. CISA did not specify how many federal systems remain unpatched as of the advisory date.
The advisory comes amid a particularly heavy patching cycle. Oracle released 943 security fixes on August 12, including 460 remotely exploitable bugs, and Microsoft addressed 421 vulnerabilities in its August Patch Tuesday update with three actively exploited zero-days. The volume has led security researchers to question whether the traditional monthly patching cadence can keep pace with AI-accelerated vulnerability discovery.
Sources: SecurityWeek; CISA KEV catalog; Palo Alto Networks Unit 42; Check Point Research; Microsoft MSRC
discussion