Four Critical KEV Additions Demand Immediate Patching Across Enterprise Stacks

As reported by SecurityAffairs, CISA has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, spanning Microsoft IKE, Microsoft SharePoint, Broadcom VMware vCenter, and Apple macOS. All four carry CVSS scores of 9.1 or higher, and at least one — the SharePoint JWT bypass — has public proof-of-concept code already being used against honeypots in the wild.

This is not a routine KEV update. The combination of a network-facing RCE (IKE), an application-layer authentication bypass with working exploit tooling (SharePoint), a path traversal in core virtualization infrastructure (vCenter), and an OS-level authentication failure (macOS) creates a broad attack surface that touches nearly every layer of the enterprise stack. Organizations that treat KEV additions as a monthly patching task rather than a 24-to-72-hour emergency response window are materially exposed.

Vulnerability Summary

Why This Matters

The SharePoint vulnerability (CVE-2026-55040) deserves particular attention. Rapid7's analysis describes a chained exploit using the alg: none JWT header trick combined with SharePoint's own STS certificate thumbprint to forge valid tokens. This is not a theoretical weakness — Defused has already observed attackers weaponizing the public PoC against honeypot deployments. Any internet-facing SharePoint Server Subscription Edition is effectively one HTTP request away from full administrative compromise.

The IKE double-free (CVE-2026-33824) is equally concerning for a different reason: it targets the VPN-adjacent IKE service commonly exposed on perimeter networks. While blocking UDP 500/4500 at the firewall reduces external attack surface, internal lateral movement remains viable. This flaw is a prime candidate for use by initial access brokers who sell network footholds to ransomware affiliates.

VMware vCenter path traversal (CVE-2026-59310) continues a troubling pattern of critical vCenter flaws. vCenter is the management plane for entire virtualized environments — compromise here means attackers can snapshot, exfiltrate, or destroy every VM under management. Given vCenter's historical patch latency in many organizations, this flaw may persist unpatched in environments for months.

Who Is Most at Risk

Shield53 Recommendations

Immediate Actions (Within 24 Hours)

• Inventory: Identify all instances of SharePoint Server SE, Windows hosts with IKE enabled, VMware vCenter deployments, and macOS endpoints. Prioritize internet-facing assets.
• Network Containment: Block UDP 500/4500 at perimeter firewalls for IKE. Restrict vCenter syslog access to management VLANs only. Place SharePoint behind WAF or reverse proxy with strict URL filtering.
• SharePoint-Specific: If patching cannot complete within 24 hours, consider temporarily disabling external access to SharePoint Server SE. Monitor IIS logs for JWT tokens with alg: none headers or suspicious STS thumbprint references.
• Detection: Deploy detection rules for anomalous JWT structures in SharePoint traffic, unexpected child processes from IKE service host (svchost.exe loading IKE extension DLLs), and vCenter syslog service file access patterns outside expected directories.

Short-Term (Within 72 Hours)

• Apply vendor patches for all four CVEs following change management protocols. Test vCenter patches in staging first — vCenter updates carry operational risk.
• Review SharePoint IIS logs and authentication logs for indicators of pre-existing compromise: forged JWT usage, unexpected admin sessions, or new site collection administrators.
• Validate macOS fleet management policies to ensure authentication bypass cannot enable persistence mechanisms.

The presence of active PoC exploitation against the SharePoint flaw elevates this KEV batch from 'important' to 'urgent.' Organizations should assume attempted exploitation, not merely theoretical risk.