CISA has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. Two directly involve authentication weaknesses of high interest to identity defenders: CVE-2026-55040, a Microsoft SharePoint weak authentication vulnerability, and CVE-2026-65400, an Apple macOS improper authentication vulnerability. The list also includes CVE-2026-33824 (a Microsoft IKE Service Extensions double free) and CVE-2026-59310 (a Broadcom VMware vCenter path traversal).
Authentication-bypass and weak-auth flaws are prime targets because they can let attackers gain unauthorized access without valid credentials, potentially serving as an initial foothold that is later leveraged for lateral movement and privilege escalation across enterprise and Active Directory environments. Under BOD 26-04, federal agencies must prioritize rapid remediation of KEV-listed flaws, especially on publicly exposed assets where exploitation could grant full control.
What to take away: Organizations should treat the SharePoint and macOS authentication issues as urgent patching priorities and review exposed collaboration and identity-adjacent services for signs of unauthorized access.