Multiple security vulnerabilities in various products are currently under attack by malicious actors. They are exploiting vulnerabilities on the internet in Microsoft Internet Key Exchange, SharePoint, VMware vCenter, and macOS. Updates have been available for some time, which IT managers should install quickly.
This is warned by the US IT security authority CISA in a security advisory. On April Patch Day, Microsoft closed a double-free security vulnerability in the service extensions of Windows Internet Key Exchange (IKE) with an update. Unauthenticated attackers from the network can inject and execute malicious code through the leak with carefully crafted requests (CVE-2026-33824, CVSS 9.8, Risk “critical”). Microsoft's vulnerability entry still considers exploitation unlikely and has apparently not yet been updated. CISA, as usual, does not specify how the attacks work. Admins should install the update quickly if they haven't already done so, and in that case, assume that affected machines are already compromised and act accordingly.
Furthermore, another security vulnerability in Microsoft's SharePoint Server is under attack. According to Microsoft's description, unauthenticated attackers can bypass a security feature over the network on the July Patch Day (CVE-2026-55040, CVSS 9.1, Risk “critical”). Here too, an update is still missing from Microsoft, and there is no mention of active exploitation in the description yet. However, this is not the only SharePoint vulnerability that Microsoft addressed in July of this year and which is already being attacked on the internet (CVE-2026-50522, CVSS 9.8, Risk “critical”). Last week, attacks on another SharePoint vulnerability also became known (CVE-2026-45659, CVSS 8.8, Risk “high”). Admins should therefore apply SharePoint updates as quickly as possible once they become available.
