CISA Adds Four Exploited Vulnerabilities to KEV Catalog Including Critical macOS Authentication Bypass
The US Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on August 18, 2026, after confirming active exploitation in the wild.
Among the newly listed issues is CVE-2026-65400 affecting Apple macOS. The flaw stems from improper authentication handling in the Screen Sharing feature and permits attackers to bypass authentication over the network even without valid credentials.
Apple released patches for the vulnerability on August 6 in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. CISA assigned the vulnerability a CVSS v3.1 base score of 9.8 and classified it as Critical.
The remaining three vulnerabilities impact Microsoft SharePoint and VMware vCenter along with additional unspecified products. All four entries were added because real-world attacks have been observed.
CISA has directed all US federal civilian agencies to remediate the listed vulnerabilities within three days of the catalog update.
Related articles
Vulnerability in Docker go-archive Library Allows File Creation and Overwrite Outside Target Directory
A vulnerability has been identified in the go-archive archive processing library used by Docker and related software. The flaw, tracked as CVE-2026-17106, affects the Unpack, UnpackLayer, and Untar functions and permits files to be created or overwritten outside the intended extraction directory. The issue stems from a mismatch between the path string validated by the code and the actual path resolved by the operating system. Docker rated the vulnerability 7.1 under CVSS v4.0 and classified it as High severity. A proof-of-concept exploit has already been published for macOS and Linux. The fix was implemented in go-archive 0.3.0 and shipped in Docker Engine 29.7.0, Docker CLI 29.7.0, and Docker Desktop 4.86.0.
Microsoft Defender Zero-Day ShieldBreak Enables SYSTEM Privilege Escalation, Bypassing July Rogue Planet Patch
Security researcher Nightmare Eclipse has publicly disclosed a new zero-day vulnerability named ShieldBreak in Microsoft Defender that allows any standard Windows account to escalate privileges directly to SYSTEM level. The flaw exploits a TOCTOU race condition in Defender's file scanning API callbacks, enabling attackers to swap file contents during the brief window when the scanner reads the file. Although linked to the earlier Rogue Planet vulnerability (CVE-2026-50656), the July patch did not fully address the attack surface, and an adjusted proof-of-concept continues to work on patched systems. Defender's high privileges and trusted status in enterprise environments amplify the risk, as compromised processes can execute malicious actions that appear legitimate in logs. Public disclosure without prior private reporting leaves a window of exposure until Microsoft issues an official fix. Blue teams are advised to enforce strict local permissions, monitor for anomalous Defender process behavior such as unusual child processes or repeated file handle operations, and implement layered defenses including application whitelisting and network segmentation.
CISA Adds Two Remotely Exploitable TrueConf Server Vulnerabilities to KEV Catalog
The US Cybersecurity and Infrastructure Security Agency has added two critical vulnerabilities affecting TrueConf Server to its Known Exploited Vulnerabilities catalog. CVE-2026-72529 allows unauthenticated remote attackers to execute arbitrary scripts due to missing authentication in a critical function. CVE-2026-72530 is a code injection flaw that enables attackers to run arbitrary code on the underlying host system by escaping the sandboxed environment. Both issues can be exploited over TCP port 4307 without requiring authentication. Kaspersky assigned CVSS v3.1 base scores of 9.8 and 9.0 respectively, rating both as Critical. US federal agencies must apply mitigations for the first vulnerability by August 23 and for the second by September 3.
Zombie Card Attack Revives Expired Visa Cards for Contactless NFC Payments
Researchers from the University of Massachusetts Amherst have demonstrated the Zombie Card attack, which enables contactless payments with certain expired Visa cards over NFC without breaking cryptography or cloning the card. The technique exploits inconsistencies in how payment terminals and issuing banks validate card expiration dates within the EMV protocol. By deploying two Android smartphones as a relay between the expired card and the terminal, the researchers intercepted the EMV field containing the expiration date and substituted a future date during the transaction. The terminal accepted the locally validated payment while the cryptographic data remained valid because Visa EMV Kernel 3 does not always bind the expiration field to the protected cryptogram. Testing showed varying bank responses: one issuer approved transactions of different amounts at multiple merchants, while another consistently declined them. The attack failed against Mastercard, American Express, and Discover due to stricter cross-checks or cryptographic protection of the expiration data. The method requires an active account and valid keys on the expired card, making it more complex than traditional skimming.