KEV Intelligence Brief — August 20, 2026

Issued by: Security Operations Intelligence | Classification: TLP:WHITE Coverage Period: August 18–20, 2026 | CVEs Covered: 8

CISA added eight vulnerabilities to the KEV catalog over the past 72 hours spanning five vendors, three architectural layers, and multiple exploitation surfaces. The entries cluster into three distinct threat narratives: a cascade of critical Microsoft and VMware infrastructure flaws demanding immediate action, an aggressive attack surface emerging across AI/ML and video conferencing developer tooling, and a credential bypass flaw targeting macOS endpoints at scale. Federal agencies and contractors operating under BOD 26-04 face hard patch deadlines as early as Friday, August 21 — some effectively overdue by the time this brief is read.

Deadline Watch: Microsoft, VMware, and Apple — Friday Is Not Optional

Three vendors account for five of this week's KEV additions, all carrying a patch deadline of August 21, 2026 — tomorrow. Organizations that have not already begun remediation are operationally behind.

CVE-2026-33824 (Microsoft IKE Service Extensions) is a double-free vulnerability enabling remote code execution within Windows VPN infrastructure. Double-free conditions in kernel-adjacent components are notoriously reliable primitives for privilege escalation chains; treat this as a potential beachhead into broader Windows environments, not merely a VPN issue. IKE services are frequently exposed at network perimeters and between network segments, amplifying blast radius.

CVE-2026-55040 (Microsoft SharePoint) describes a weak authentication bypass allowing unauthenticated network access to bypass a security feature. SharePoint is pervasive in federal contractor environments and frequently holds sensitive documents and integrated workflows. An authentication bypass here isn't a theoretical risk — it is an active credential-free path into organizational data stores. Teams running on-premises SharePoint should treat this as emergency-tier; SharePoint Online operators should verify Microsoft's service-side remediation status and consult tenant security advisories.

CVE-2026-59310 (Broadcom VMware vCenter) is a path traversal vulnerability permitting arbitrary code execution for any threat actor with network access to vCenter. VMware vCenter vulnerabilities have a documented history of rapid weaponization by nation-state and ransomware actors. Network-level access to vCenter — often assumed to be an internal-only risk — is increasingly achievable through earlier-stage footholds. If your vCenter management interface is not strictly isolated from general corporate network segments, that architectural gap is now your most urgent compensating control, independent of patching timeline.

CVE-2026-65400 (Apple macOS) enables a network-adjacent attacker to authenticate to Screen Sharing without valid credentials. This is a credential-less remote control capability. In enterprise environments where macOS endpoints are common among engineering and executive staff, this vulnerability provides an interactive foothold requiring no phishing, no malware delivery, and no password. Organizations should immediately audit Screen Sharing enablement across the fleet and disable the service where it is not operationally required, even before patch deployment. Credential rotation for accounts on affected systems is strongly advised.

All four require patching by August 21 under BOD 26-04. Contracting officers and security leads should document remediation progress now for audit purposes.