CISA encourages rapid remediation of KEV Catalog vulnerabilities. Affected vendors (Microsoft, Broadcom, Apple) should be consulted for patches. Federal agencies must check for prior compromise before patching per BOD 26-04 requirements. All organizations should adopt risk-based vulnerability management and prioritize remediation of KEV-listed vulnerabilities on publicly exposed assets.
Quick answers
What is CVE-2026-33824?
CISA encourages rapid remediation of KEV Catalog vulnerabilities. Affected vendors (Microsoft, Broadcom, Apple) should be consulted for patches. Federal agencies must check for prior compromise before patching per BOD 26-04 requirements. All organizations should adopt risk-based vulnerability management and prioritize remediation of KEV-listed vulnerabilities on publicly exposed assets.
How severe is CVE-2026-33824?
high
Is CVE-2026-33824 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-33824 be mitigated?
CISA encourages rapid remediation of KEV Catalog vulnerabilities. Affected vendors (Microsoft, Broadcom, Apple) should be consulted for patches. Federal agencies must check for prior compromise before patching per BOD 26-04 requirements. All organizations should adopt risk-based vulnerability management and prioritize remediation of KEV-listed vulnerabilities on publicly exposed assets.
CVSS
—
Vendor
Microsoft
Published
Sep 30, 2026 · 08:42
Patch
Unknown / not confirmed
Affected products
Microsoft Internet Key Exchange (IKE) Service Extensions, Microsoft SharePoint, Broadcom VMware vCenter, Apple macOS
Mitigation
CISA encourages rapid remediation of KEV Catalog vulnerabilities. Affected vendors (Microsoft, Broadcom, Apple) should be consulted for patches. Federal agencies must check for prior compromise before patching per BOD 26-04 requirements. All organizations should adopt risk-based vulnerability management and prioritize remediation of KEV-listed vulnerabilities on publicly exposed assets.
On August 18, 2026, CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation in the wild. The additions include a Microsoft IKE Service Extensions double-free flaw, a SharePoint authentication bypass, a VMware vCenter path traversal, and an macOS improper authentication issue. CISA's Binding Operational Directive 26-04 reinforces rapid remediation requirements for Federal Civilian Executive Branch agencies on publicly exposed assets.