U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-33824 (CVSS score: 9.8) – Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability CVE-2026-55040 (CVSS score: 9.1) Microsoft SharePoint Weak Authentication Vulnerability CVE-2026-59310 (CVSS score: 9.8) Broadcom VMware vCenter Path Traversal Vulnerability CVE-2026-65400 Apple macOS Improper Authentication Vulnerability CVE-2026-33824 is a Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability. This critical flaw in Windows IKE service extensions could allow remote attackers to execute code on affected systems. Systems with IKE enabled are at risk, though blocking UDP ports 500 and 4500 can reduce exposure from external threats. However, internal attackers may still exploit it for lateral movement, so rapid patching is strongly recommended. CVE-2026-55040 is a critical SharePoint authentication bypass. An unauthenticated attacker can exploit weaknesses in JWT validation to forge tokens and impersonate any SharePoint user, including administrators. “A critical authentication bypass vulnerability exists in SharePoint Server Subscription Edition’s JWT token validation pipeline. The root cause is a chain of four distinct weaknesses that, when combined, allow an unauthenticated remote attacker to forge a valid JWT and impersonate any SharePoint site user.” wrote Rapid7. The exploit chain works by sending a JWT with “alg: none” in the outer header so no signature is required, using SharePoint’s own STS certificate thumbprint to resolve a signing key without verification, and then passing a non-empty but never-verified signature like “AAAA.” The result is a fully forged token that SharePoint accepts as legitimate. Defused researchers observed attackers using the Rapid7 POC for CVE-2026-55040 against our SharePoint their honeypots. CVE-2026-59310 flaw is a Path Traversal Vulnerability that allows an attacker with network access to execute arbitrary code. “VMware vCenter contains a directory traversal vulnerability in the Syslog server. Broadcom has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.”states the advisory.”A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.” CVE-2026-65400 is an Improper Authentication Vulnerability that sits in macOS’s built-in Screen Sharing feature, the remote desktop tool baked into every Mac.On August 15, 2026, the Dutch National Cyber Security Centre confirmed active exploitation of a critical macOS authentication flaw, less than two weeks after Apple shipped the fix. Apple’s fix improved how the system manages authentication state, closing a gap that let attackers on the network authenticate to Screen Sharing without valid credentials at all. Apple patched this issue with the release of macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9, crediting researcher Alfredo Pesoli (@__rev) at Bynario Atlas (bynar.io) for the discovery. “An attacker on the network may be able to authenticate to Screen Sharing without valid credentials” reads the advisory. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaws by August 21, 2026 Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
We provide guidance for preparing for and mitigating large-scale credential attacks, focusing on recent campaigns targeting security vendors' devices. The post Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18) appeared first on Unit 42.
A Heights Finance breach exposed personal and financial data of over 1.2 million people after hackers compromised a third-party cloud platform. Heights Finance is a U.S. consumer finance company that provides personal loans and related lending services, mainly to customers who may have limited access to traditional bank credit. It is part of Heights Finance Holdings Co. Heights Finance Holdings is notifying more than 1.2 million people that on May 7, 2026, Heights Finance discovered unauthorized access to a third-party cloud platform storing customer data. The company launched an investigation with external cybersecurity experts and notified federal law enforcement. “On May 7, 2026, Heights discovered that an unauthorized actor gained access to a cloud-based platform hosted by a third party that we use to store certain customer data. This activity was limited to the cloud-based platform only—it did not affect any of our loan management systems or other computer systems or networks. We immediately activated our incident response protocols, brought in outside cybersecurity specialists to investigate, and reported the incident to federal law enforcement.” reads the notice of data breach. “We have since confirmed that the cloud-based platform is secure and that there is no ongoing security threat. Our operations were not impacted by this incident and have continued safely and securely.” Heights said its internal systems and operations were not affected, the platform has been secured, and there is no ongoing threat. The compromised customer information included contact details, financial and bank account data, government IDs and dates of birth. The affected data varies by person and may involve Heights Finance customers, loan applicants, people who inquired about its products, or former borrowers of Curo Management and related brands. Heights Finance is offering affected individuals 24 months of free credit monitoring and identity protection. The company said dark web monitoring has found no evidence that the stolen data has been published. No threat actor has claimed responsibility, and no known ransomware or extortion group has been linked to the breach so far. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Heights Finance)
A custom Java web shell likely linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPLM servers, with built-in features to decrypt credentials, enumerate file repositories, and steal files. Cybersecurity company ReliaQuest analyzed the web shell after it is believed to have been deployed in recent data theft attacks exploiting CVE-2026-12569, a critical remote code execution vulnerability affecting PTC Windchill. ReliaQuest says the implant is not a generic web shell repurposed for the attacks, but was instead built with detailed knowledge of Windchill's internal APIs, database schema, keystore, and file-vault structure. "This appears to be an application-specific evolution of Clop's established mass-exploitation playbook," ReliaQuest said in a report shared with BleepingComputer.
Security controls can block a familiar attack method while missing quieter ways to achieve the same objective. Picus Security's Blue Report 2026 shows how prevention rates can vary dramatically by technique and why behavioral testing is needed to uncover those gaps.
Microsoft has started testing a faster File Explorer and a less cluttered and more customizable context menu in Windows 11 preview builds rolling out to Insiders this week. As the File Explorer team explained in a Monday blog post, the changes focus on improving File Explorer speed, performance, and reliability and addressing customer-reported issues. The redesigned context menu experience also aims to make it faster, reduce clutter, and make it more customizable than ever before. At the bottom of the new right-click menu, Microsoft also added a "Customize menu" shortcut to the Settings page, where users can tweak the context menu to suit their preferences. "We've continued refining File Explorer based on that feedback, removing friction and improving the details that help make everyday tasks feel more natural and predictable. For example, file renames no longer get interrupted by background file synchronization, and case-only filename changes now appear immediately," Microsoft said.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a high-severity Windows Task Host vulnerability that was flagged as actively exploited in April. Task Host is a core Windows system component that allows DLL-based processes to run in the background and prevents data corruption by ensuring they close properly during shutdown. Tracked as CVE-2025-60710, this Windows privilege escalation security flaw was patched by Microsoft in November 2025 and stems from a link following weakness that affects Windows 11 and Windows Server 2025 devices. Following successful exploitation, local attackers with basic user permissions can gain SYSTEM privileges and take full control of unpatched devices. While it didn't share any details regarding ongoing attacks and Microsoft has yet to update its security advisory to confirm in-the-wild exploitation, CISA added CVE-2025-60710 to its list of actively exploited vulnerabilities on April 13 and gave Federal Civilian Executive Branch (FCEB) agencies two weeks to secure their systems.
Microsoft says some users are experiencing issues searching in Microsoft 365 apps, including Outlook on the web, Outlook desktop, SharePoint Online, and OneDrive. According to an incident report seen by BleepingComputer and tracked under MO1456424 in the Microsoft 365 Admin Center, the root cause is what Microsoft describes as a recent deployment that causes resource utilization problems. "Impact is specific to some users served through the affected infrastructure who are attempting to search for content in SharePoint Online, OneDrive, Outlook on the web, or Outlook desktop," Microsoft said. "Our investigation identified that a recent deployment introduced a resource utilization inefficiency issue, leading to impact." Microsoft says it has already developed a fix and deployed it to reduce resource pressure and restore service for all affected Microsoft 365 users.
Microsoft announced that it removed the Windows Management Instrumentation Command-line (WMIC) tool from Windows 11 24H2 and 25H2, as well as from Windows 11 beta builds released this week. WMIC is a legacy built-in Windows command-line utility that helps interact with the Windows Management Instrumentation (WMI) system using text commands. This move is part of a process announced in September, when the company said that WMIC will be removed after upgrading to Windows 11 25H2 and later. Microsoft deprecated WMIC in Windows Server 2012 (in 2016) and Windows 10 21H1 (in 2021), and it converted it into a Feature on Demand (FoD) starting with Windows 11 22H2 (in 2022), and announced in January 2024 that it would be removed altogether after first disabling it by default. "Windows Management Instrumentation Command-line (WMIC) has been removed in this release. This change is part of the ongoing deprecation and removal of WMIC from Windows," Microsoft noted on Monday.
A ransomware affiliate calling itself Ransom Busters has been spotted proactively sending emails to victim organizations and claims to delete stolen data from ransomware groups' servers in exchange for a fee ranging from $20,000 to $60,000. "In these messages, the third-party offers to help the victim recover from ransomware attack. This immediately stands out as anomalous," GuidePoint Research
Confirm this action.
Leaving now will discard your changes.