If you run Windows Server with an IKEv2 VPN, patch it today. CVE-2026-33824 is a CVSS 9.8 double-free in the Windows IKE service that needs no credentials and no user interaction, Microsoft fixed it on April 14, and CISA added it to the Known Exploited Vulnerabilities catalog on August 18 with a due date of today. If your April cumulative update landed, you are already covered. Most of the work this week is proving that.

NVD describes it plainly: "double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network." Microsoft's own FAQ scopes the precondition — "an unauthenticated attacker could send specially crafted packets to a Windows machine with Internet Key Exchange (IKE) version 2 enabled." ZDI's writeup puts the bug in ikeext.dll, reachable on UDP 500 and 4500, triggered "during the IKE_SA_INIT exchange" while processing fragmented messages.

The affected list is wider than VPN servers. Microsoft's April CVRF data marks 27 product entries known-affected, spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Windows Server 2025 — client and server, Core and full. The exposure question is not which SKU you run, it is which hosts answer on UDP 500 or 4500 from somewhere you do not control.

What changed this month is the exploitation evidence, not the fix. Unit 42 reported in July that an actor it tracks under the aliases "knaithe" and "KnYuan" kept working exploit tooling for seven vulnerabilities including CVE-2026-33824, and logged "reverse shell callbacks targeting three IKE VPN endpoints." The actor "attempted to exploit over 460 targets"; Unit 42 confirmed success on Citrix NetScaler and Marimo notebook hosts, not on the IKE endpoints. Microsoft's CVE entry still reads Exploited:No and "Exploitation Less Likely," revised once since April — on August 20, to add "clarifying information to the mitigation." KEV is the field to triage on this week.

The three-day clock follows from BOD 26-04, the risk-based directive from #010, whose shortest tier covers bugs that are internet-exposed, on KEV, automatable, and grant total control. An internet-facing IKE responder hits all four. Three other KEV entries drew the same August 21 date — VMware vCenter, on-prem SharePoint, and macOS — and all four had a vendor fix out before CISA listed them, the newest by twelve days and this one by over four months. The gap is not vendor response time. It is the distance between a patch shipping and you being able to prove it landed.

The August release is bigger but less urgent. Tenable counts 398 CVEs — "42 rated critical, 355 rated as important and one rated as moderate" — with three zero-days, one of them exploited. That one is CVE-2026-68820, a use-after-free in the Ancillary Function Driver for WinSock that Tenable scores at CVSSv3 7.0. It is a local privilege escalation, a step inside an intrusion rather than a way in, and CISA gave it an August 25 deadline.

What to do this week:

1. Prove the April update landed on every Windows host, not just servers. Query your RMM or WSUS for the April 2026 cumulative build per device, and treat missing data as unpatched. Machines that were off, imaged from stale media, or excluded from a ring are where this survives.
2. Inventory what answers on UDP 500 and 4500. Scan your own perimeter rather than trusting the firewall rule base. ZDI's interim guidance is to "block inbound traffic on UDP ports 500 and 4500 for systems that do not use IKE," or restrict those ports "only from known peer addresses" where IKE is genuinely in use.
3. Hunt on anything that was exposed and unpatched between April and now. Check for IKE service crashes and restarts in the System log, new local accounts, and outbound connections from a host whose only job is terminating VPN tunnels.
4. Close the other three August 21 entries in the same change window. vCenter, SharePoint, and macOS Screen Sharing are below.

Advisories

An unauthenticated 9.8 in vCenter reaches code execution through the Syslog server

If you run vCenter on-prem, patch it this week. CVE-2026-59310 is a directory traversal "in the Syslog server," and per NVD "a malicious actor with network access to vCenter may exploit this issue to execute arbitrary code." It scores 9.8. CISA added it August 18, due today. The same VMSA-2026-0006.2 covers CVE-2026-59309, a separate 9.8 authentication bypass in the VMware Directory Service, closed by the same patch.

Action: upgrade vCenter 9.1.x to 9.1.0.0300, 9.0.x to 9.0.2.0100, and 8.0 to 8.0 U3k or 8.0 U2f. Broadcom lists no workaround for either CVE, and 7.0 needs an extended support contract. Scope an unpatched exposed appliance as every guest on every host it manages.

A SharePoint bug Microsoft shipped a fix for in July is now exploited

CVE-2026-55040 hit KEV August 18, due today. NVD rates it 9.1: "weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network." Microsoft's FAQ is more direct — "an unauthenticated attacker could bypass authentication and make an anonymous connection," and the bypass "allows impersonation." The fix shipped in the July Patch Tuesday covered in #014. August added 29 more SharePoint CVEs on top.

Action: confirm the July update across SharePoint Enterprise Server 2016, Server 2019, and Subscription Edition — KB5002882, KB5002883, and KB5002891 — then apply August. Check the build per server, not per farm: one server left behind is the exposed case. If an internet-reachable farm ran unpatched past July 14, review it for account and content changes you cannot account for.

macOS Screen Sharing accepts a network attacker without valid credentials

CVE-2026-65400 is on KEV as of August 18, due today, and NVD scores it 9.8. Apple's description is one line: "an attacker on the network may be able to authenticate to Screen Sharing without valid credentials," fixed by "an authentication issue was addressed with improved state management." The Tahoe 26.6.1 notes date the release August 6, 2026.

Action: get Macs to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9. Then audit where Screen Sharing is enabled at all — your MDM can report the state across the fleet faster than you can ask around. Remote Management should not be reachable from a guest VLAN or a client network.

Microsoft Defender has a publicly disclosed local escalation and no patch

Microsoft's August CVRF carries CVE-2026-69414, an elevation of privilege "in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as" ShieldBreak. Microsoft rates it CVSS 7.8, flags it Publicly Disclosed and not exploited, and says: "we are working to provide a high quality security update that addresses this vulnerability." Per BleepingComputer, a researcher published the proof of concept after August Patch Tuesday, claiming "a full patch bypass" of the earlier RoguePlanet fix; analyst Will Dormann confirmed "the ShieldBreak exploit works" where Defender is enabled.

Action: there is nothing to install yet, so do not build a patch task. Track the CVE for a revision, and treat local admin and interactive logon on managed endpoints as the control that matters — the exploit needs a foothold first. Do not disable Defender over this.

The rest of this week's KEV additions

Thirteen CVEs joined KEV between August 7 and today. Beyond the four above: CVE-2026-73570 in Zimbra Collaboration Suite (added today, due August 24), CVE-2026-72529 and CVE-2026-72530 in TrueConf Server, CVE-2026-64849 in MLflow, CVE-2025-62593 in Ray, CVE-2026-72898 in Metabase, CVE-2026-20349 in Cisco Secure Firewall ASA and FTD, and CVE-2026-8037 in Progress LoadMaster. All 13 carry knownRansomwareCampaignUse: Unknown.

Action: the two worth checking even if you think you do not run them are MLflow and Ray. Both arrive through a data-science team or a client proof of concept rather than procurement, so they rarely reach an asset list. Search by listening port and process name.

Product changes

Entra turns on passkeys for your SMS and voice users on September 1

Per Microsoft Learn, "starting September 1, 2026, passkeys become the default authentication experience and will be automatically enabled for users enabled for SMS or voice." Two things move at once: those users get auto-enabled for passkeys in the Authentication Methods Policy, and "your Registration Campaign settings will be set to Microsoft Managed state targeting passkeys." Users then get nudged at their next MFA sign-in, with "unlimited snoozes." Microsoft-provided SMS and voice retire February 1, 2027, and there is "no opt out from this February 1 behavior."

Action: find out which tenants are in scope now — Microsoft points at a PowerShell script that lists SMS and voice users and needs only Global Reader. To delay a tenant, PATCH the authentication methods policy and set optOutSettings.passkeyDynamicMigration to true; that needs the Graph Policy.ReadWrite.AuthenticationMethod permission, and there is no portal toggle. It buys until February 1, not past it.

Licensing

CSP annual-term software billed monthly costs 5% more from October 1

Microsoft told partners on August 12 that "starting October 1, 2026, Microsoft applies a 5% cost of capital uplift for Cloud Solution Provider (CSP) software subscriptions (such as SQL Server, Windows Server, Client Access Licenses, and System Center) with annual-term commitments billed monthly." Annual billing and month-to-month subscriptions are unchanged. For existing subscriptions "the 5% uplift takes effect at renewal on or after October 1, 2026." An earlier partner communication carried the wrong effective date, so check which one your team filed.

Action: pull every annual-term software subscription you bill monthly and sort by renewal date. Anything renewing on or after October 1 needs a repriced quote before it auto-renews, or you absorb the 5%. Separately, the August CSP price list was republished on August 13 to add the Windows Server 2016 ESU offers — redownload it if you pulled it earlier.

Compliance

CISA's new logging guidance is a usable benchmark even if you have no federal clients

CISA published the Logging Reference Architecture on August 20, implementing OMB memorandum M-26-14. Federal civilian agencies must submit an Agency Logging Plan to OMB and CISA by November 18, 2026. The guidance ships operational checklists covering logging architecture design, "baseline logging fidelity," and operational readiness. CISA says it "encourages critical infrastructure entities and state, local, territorial, and tribal government organizations to review the guidance to benchmark their own logging and monitoring plans."

Action: if you serve state, local, or critical-infrastructure clients, read the checklists before someone puts them in an RFP. For everyone else they are a free gap analysis: run your largest client's log sources against them and see what you cannot answer. Every KEV entry this week also cites the Forensics Triage Requirements, and triage needs logs you were already keeping.

Field notes

Six agencies say Gunra's way in is an unpatched firewall or VPN

FBI, CISA, DC3, NSA, the Secret Service, and Korea's National Police Agency published #StopRansomware: Gunra. Gunra "first emerged in April 2025 as a sophisticated double-extortion ransomware variant" derived from the leaked Conti source code, and "as of January 2026, Gunra launched a formal RaaS affiliate program on dark web forums." The FBI observed initial access "primarily through the exploitation of known vulnerabilities in internet-facing devices," naming firewall and VPN appliances and two FortiOS and FortiProxy authentication bypasses, CVE-2024-55591 and CVE-2025-24472. Against one victim, actors used default credentials on an SSL-VPN admin account "when account lockout controls were not present." Against another, they edited authentication files on a VDI portal so a chosen one-time password value always succeeded, "enabling the continuous bypass of multi-factor authentication."

Action: carry the OTP-bypass detail into your own environment. MFA enforced by a server you also manage is only as good as that server's integrity — the same lesson as the N-central compromise in #016. Audit appliance admin accounts for defaults and missing lockout, and confirm that authentication config changes on VPN and VDI brokers alert somewhere you read.