CISA flags four actively exploited flaws in Microsoft, VMware and Apple products

Key points

• CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog, a public list of software flaws being used in real attacks.
• The affected products are Microsoft SharePoint, Microsoft's Windows IKE networking service, Broadcom VMware vCenter, and Apple macOS.
• Federal civilian agencies must patch these under Binding Operational Directive 26-04, which sets deadlines for fixing high-risk flaws.
• CISA is urging every organisation, not just government, to prioritise these four fixes.
• The bugs cover authentication bypass, path traversal, and memory corruption, all classic routes to taking over a machine.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added four more software bugs to its running list of flaws that criminals are actively abusing in the wild.

That list, the Known Exploited Vulnerabilities catalog, is the closest thing the industry has to a "patch these first" board. If a flaw lands on it, someone has already been caught using it against real victims.

This batch hits four big names: Microsoft, Broadcom's VMware, and Apple.

What are the four flaws?

The short version: two Microsoft bugs, one VMware bug, and one Apple bug, all being exploited now. Each one gives an attacker a foothold or full control if the target machine has not been patched.

Here is what CISA published, per its advisory:

In plain English: the SharePoint and macOS bugs let an attacker sneak past the login checks. The vCenter path traversal, meaning a trick that lets an attacker read or write files outside the folder they are supposed to be in, is nasty because vCenter runs entire virtual data centres. And the Windows IKE double free, a memory-handling bug in the service that negotiates encrypted network tunnels, can be pushed into remote code execution if an attacker knows what they are doing.

The vCenter one should be the loudest alarm for cloud and platform teams. Own vCenter and you own the hypervisor, meaning every virtual machine sitting on top of it.

Who has to patch, and by when?

US federal civilian agencies are on the clock under Binding Operational Directive 26-04, CISA's rule that forces government bodies to fix KEV-listed flaws quickly, especially on anything reachable from the public internet.

BOD 26-04 also does something the older directive did not: it tells agencies they need to check whether attackers already got in before the patch went on. In practice, that means log review and threat hunting, not just running Windows Update and calling it done.

The directive only binds federal agencies. But CISA is asking every private company to treat the KEV list the same way. That advice is worth taking. If a bug is on the KEV list, the exploit is not theoretical anymore.

Should ordinary people worry?

Not directly, but the knock-on effects are real. SharePoint stores corporate documents. vCenter runs the servers behind hospital systems, retailers and government portals. When these get popped, customer data leaks and services go down.

If you are a customer of an organisation that uses these products, and most large ones do, the sensible move is the usual one: watch for unusual account activity, turn on multi-factor authentication where offered, and be skeptical of any "please reset your password" email that arrives in the next few weeks.

For IT teams, the failure mode here is familiar. Public-facing SharePoint and vCenter instances that nobody remembered to inventory. One thing the post-mortem will say, again, is that the patch was available but the asset was not on anyone's list.

Operational takeaway: pull your KEV list into your ticketing system today, tag anything internet-facing, and treat these four as this week's problem.