CISA Adds Four Exploited Vulnerabilities to KEV Catalog Including Critical macOS Authentication Bypass
The US Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on August 18, 2026, after confirming active exploitation in the wild.
Among the newly listed issues is CVE-2026-65400 affecting Apple macOS. The flaw stems from improper authentication handling in the Screen Sharing feature and permits attackers to bypass authentication over the network even without valid credentials.
Apple released patches for the vulnerability on August 6 in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. CISA assigned the vulnerability a CVSS v3.1 base score of 9.8 and classified it as Critical.
The remaining three vulnerabilities impact Microsoft SharePoint and VMware vCenter along with additional unspecified products. All four entries were added because real-world attacks have been observed.
CISA has directed all US federal civilian agencies to remediate the listed vulnerabilities within three days of the catalog update.
Related articles
N-able Releases Hotfix 4 for Critical N-central RCE Flaw CVE-2026-86218 Now Confirmed Exploited
N-able disclosed a critical vulnerability in its N-central IT operations management platform that allows unauthenticated remote code execution on affected servers. The flaw, tracked as CVE-2026-86218, received the maximum CVSSv4.0 base score of 10.0 and is rated Critical. The company published security advisory information on September 5, 2026, and quickly followed with Hotfix 4 (version 2026.3.1.14) that resolves the issue. Although exploitation was not observed at disclosure, N-able updated the advisory the next day to confirm active exploitation in the wild. The vendor urges customers to apply the hotfix immediately and to monitor for suspicious account creation and scanning activity from specific IP addresses. Earlier hotfixes addressing CVE-2026-86206 and CVE-2026-86207 were superseded by the new release.
Critical Zero-Day CVE-2026-75650 in Adobe Commerce and Magento Allows Unauthenticated Remote Code Execution, Already Exploited
Adobe has released an emergency security update for Adobe Commerce and Magento after discovering a critical zero-day vulnerability that permits remote attackers to execute arbitrary code without authentication. The flaw, tracked as CVE-2026-75650, stems from improper sanitization of special elements in the template engine and carries the maximum CVSSv3.1 base score of 10.0. Adobe rates the issue as Critical and confirms active exploitation in real-world attacks. A hotfix is now available, and the company has assigned the highest priority rating of 1, urging all customers to apply the update within 72 hours. The advisory was published on September 7, 2026, highlighting the need for immediate action due to the severity and confirmed abuse.
Exploiting SSTI Vulnerability in Messenger Machine on Standoff 365 Leads to RCE and Corporate Chat Access
A detailed writeup published by Positive Technologies researcher Seven11eleven demonstrates a full attack chain against the vulnerable Messenger machine on the Standoff 365 platform. The researcher began with network reconnaissance using nmap and directory fuzzing with ffuf, uncovering Swagger documentation and JWT-protected endpoints. After identifying user enumeration through the friend search feature, the team discovered a Server-Side Template Injection flaw in the friendship summary functionality powered by the Mako template engine. The SSTI was escalated to remote code execution by injecting Python expressions that leveraged the self.module.cache.util chain to call os.popen commands. With initial access obtained via reverse shell, the attacker pivoted to neighboring services including Gitness, RabbitMQ, and Redis to achieve the defined business risks of accessing developer corporate messaging and extracting the city messenger encryption key.
SCCM Misconfigurations Expose Organizations to Full Infrastructure Takeover
BI.ZONE expert Alexander Kuznetsov details how Microsoft Configuration Manager (SCCM) deployments in 25% of Russian organizations can grant attackers complete control over corporate infrastructure when misconfigured. The article outlines critical risks including administrative privilege escalation, lateral movement, data collection, persistence, and policy manipulation that allow attackers to blend with legitimate maintenance operations. Key recommendations focus on infrastructure isolation, placing Site Server, SMS Provider, and Site Database Server roles in Tier 0 segments, and avoiding single SCCM hierarchies across multiple Active Directory forests or security tiers. The report emphasizes eliminating Network Access Account (NAA) usage in favor of HTTPS or Enhanced HTTP, strictly limiting Client Push Account and domain join account privileges, and auditing computer accounts for site servers. Additional guidance covers PXE deployment risks, database access restrictions, and role-based administrative controls to prevent credential extraction via tools such as SharpSCCM and mimikatz. Overall, the publication provides actionable hardening steps aligned with the principle of least privilege to reduce the attack surface of widely deployed SCCM environments.