Security researchers confirmed that cyber threat actors are actively using autonomous AI frameworks (powered by DeepSeek) to scan, target, and execute exploits against critical enterprise infrastructure. The CISA also warns of AI-Powered zero day targets Microsoft Windows and VMware.
The campaign targeted CVE-2026-33824—a maximum-severity pre-authentication flaw in Microsoft’s Internet Key Exchange (IKE) service. Following evidence of widespread active exploitation, CISA added the Microsoft IKE bug alongside three other critical zero-days to its Known Exploited Vulnerabilities (KEV) catalog.
How Microsoft IKE Service RCE happened?
Microsoft said in the advisory,
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network. Customers who cannot immediately install the security update can take one of the following actions, depending on their environment:
- Block inbound traffic on UDP ports 500 and 4500 for systems that do not use IKE.
- For systems that require IKE, configure firewall rules to allow inbound traffic on UDP ports 500 and 4500 only from known peer addresses.
The CISA added Four Newly Known Exploited Vulnerability (KEV)
1. Microsoft Internet Key Exchange (IKE) Extensions (`CVE-2026-33824`) — CVSS 9.8
- The Flaw: A pre-authentication double-free vulnerability in Windows IKE Service Extensions.
- Impact: Unauthenticated remote attackers can send crafted UDP packets to execute arbitrary code with `SYSTEM` privileges over the network.
2. Broadcom VMware vCenter (`CVE-2026-59310`) — CVSS 9.8
- The Flaw: A path traversal vulnerability in vCenter Syslog servers.
- Impact: Allows remote attackers with network access to execute arbitrary commands. Threat actors (including China-nexus APT groups) have actively exploited it to drop backdoors and deploy ransomware.
3. Apple macOS Screen Sharing (`CVE-2026-65400`) — CVSS 9.8
- The Flaw: An improper authentication handling flaw in the `screensharingd` daemon.
- Impact: Network-adjacent attackers can bypass authentication checks and connect to Screen Sharing without valid credentials.
4. Microsoft SharePoint Server (`CVE-2026-55040`) — CVSS 9.1
- The Flaw: A weak authentication enforcement flaw in on-premises SharePoint deployments.
- Impact: Attackers can forge tokens and bypass security checks over a network to access restricted internal assets.
Action Required
- Patching: System administrators must immediately apply emergency updates across all affected Windows, macOS, VMware, and SharePoint systems.
- Network Mitigation for IKE: If Windows updates cannot be applied right away, block inbound traffic on UDP Ports 500 and 4500 at the network perimeter.
