Four Actively Exploited Flaws: A 72-Hour Patch Playbook for SMBs

A long vulnerability list is easy to ignore. A short list of flaws already being exploited deserves a different response. On 18 August, CISA added four vulnerabilities affecting Microsoft IKE, Microsoft SharePoint, VMware vCenter, and Apple macOS to its Known Exploited Vulnerabilities Catalog.

CISA adds entries to this catalog based on evidence of active exploitation. That does not mean every business using the product is compromised. It means the risk has moved beyond a laboratory scenario, and attackers have a working path against at least some real targets.

CISA's binding remediation directive applies to U.S. federal civilian agencies. It does not automatically impose the same deadline on private businesses in Europe or Latin America. CISA nevertheless encourages all organizations to prioritize exploited vulnerabilities, and the underlying logic is sound for any growing company.

What happened

The four catalog additions were:

1. CVE-2026-33824, a Microsoft Internet Key Exchange service extensions double-free vulnerability.
2. CVE-2026-55040, a Microsoft SharePoint weak-authentication vulnerability.
3. CVE-2026-59310, a Broadcom VMware vCenter path-traversal vulnerability.
4. CVE-2026-65400, an Apple macOS improper-authentication vulnerability.

The technologies cover different layers. IKE supports network security and VPN-related functions. SharePoint may hold business documents and workflows. vCenter administers virtual infrastructure. macOS endpoints may access email, finance, customer, and cloud systems. Exposure therefore depends on the exact version, deployment, network reachability, and compensating controls.

The right response is not panic patching without context. It is fast inventory, prioritized remediation, and an evidence check for systems that were exposed before the fix.

Why it matters for growing businesses

Many SMBs outsource infrastructure management but retain the business risk. “Our IT provider handles updates” is not enough during an exploited-vulnerability event. Management should be able to obtain a clear answer showing affected assets, exposure, remediation status, exceptions, and evidence reviewed.

Patching also does not remove an attacker who arrived earlier. If a vulnerable system was internet-facing or reachable from a compromised network while exploitation was active, the business may need to inspect authentication events, new accounts, configuration changes, unusual processes, file access, outbound connections, and endpoint alerts.

This is why vulnerability management and incident response must connect. A patch closes a known door. It does not tell you whether someone is already in the kitchen judging your appliance choices.

The first 24 hours: establish exposure

1. Assign an incident owner. One person coordinates IT, the managed provider, system owners, and management updates.
2. Identify affected products and versions. Check endpoint management, software inventory, virtualization records, SharePoint deployment details, and network appliances.
3. Confirm internet exposure. Determine whether affected services are directly reachable, published through a gateway, VPN-accessible, or restricted internally.
4. Check vendor guidance. Use official Microsoft, Broadcom, Apple, and CISA advisories for fixed versions and mitigations.
5. Protect evidence. Preserve relevant logs before rotation or cleanup. Record timestamps, asset identifiers, versions, and current configuration.
6. Apply temporary containment where necessary. Restrict access, disable vulnerable services, remove public exposure, or isolate a host when a patch cannot be applied immediately.

Hours 24 to 48: remediate and hunt

Patch or upgrade affected systems according to vendor guidance. Validate that installation completed and the running version changed. A deployment console saying “success” is useful, but direct verification on the target is better.

For systems exposed during the risk window, check for compromise indicators. Review privileged logins, failed authentication bursts, newly created accounts, service changes, scheduled tasks, suspicious child processes, unexpected archive files, unusual administrative actions, and outbound traffic. Escalate anomalies instead of explaining them away to protect the maintenance window.

If the system is critical, take snapshots or backups according to the incident plan before making destructive changes. Coordinate with a security specialist when evidence suggests intrusion. Rebuilding may be safer than trusting an uncertain cleanup.

Hours 48 to 72: verify and close gaps

1. Re-scan the environment and confirm no affected version remains.
2. Test business services, VPN access, document workflows, and virtualization operations after remediation.
3. Confirm endpoint detection and centralized logging are active on affected assets.
4. Document assets not patched, the reason, temporary controls, owner, and deadline.
5. Reset credentials or tokens where evidence or exposure justifies it.
6. Brief management with facts: affected, exposed, patched, investigated, unresolved, and next action.
7. Add lessons to the vulnerability process, including faster inventory queries and clearer emergency authority.

How VDS Consultoria can help

VDS Consultoria helps growing businesses maintain asset inventories, patch priorities, Odoo and infrastructure backups, provider accountability, endpoint monitoring, and practical incident playbooks. We can coordinate technical checks with business owners so remediation protects operations rather than creating a second outage.

The useful habit is simple: when exploitation is confirmed, move from a monthly maintenance mindset to an incident mindset. Identify exposure, patch quickly, look backward for evidence, and verify the result. Security improves when “done” means checked, not merely assigned. Keep the final record with the asset inventory and incident plan so the next alert starts with known owners and reliable data instead of a fresh spreadsheet hunt.

Source

CISA, “CISA Adds Four Known Exploited Vulnerabilities to Catalog,” 18 August 2026: https://www.cisa.gov/news-events/alerts/2026/08/18/cisa-adds-four-known-exploited-vulnerabilities-catalog