Windows IKE RCE and vCenter path traversal, both exploited, both unauth

Attackers can inject and run arbitrary code on Ray clusters through a code injection bug. The catch: exploitation currently works through Firefox and Safari, meaning a developer browsing a malicious page while Ray is accessible could hand over their cluster. This is exploited in the wild, but the attack requires a developer to be using one of those browsers with Ray's dashboard or API reachable locally.

Affected estate

ML engineers and platform teams running Ray clusters, especially those with Ray dashboards accessible from developer workstations

How to check

Run 'ray --version' or 'pip show ray' to check the installed version. Verify whether the Ray dashboard (default port 8265) is exposed beyond localhost.

Included because

remote code execution; exploited in the wild; common ML development tool; browser-based attack vector

Action

Upgrade Ray to the latest release. Lock down dashboard and API access to localhost or a trusted network segment.

Why it matters

A developer visiting a malicious website in Firefox or Safari could unknowingly give an attacker full code execution on your Ray cluster.

An attacker with network access to your vCenter Server can use a path traversal bug to execute arbitrary code. No authentication is required. This is exploited in the wild, and compromising vCenter means the attacker owns your entire VMware environment.

Affected estate

VMware admins running vCenter Server on-prem or in hybrid environments

How to check

Log into the vCenter VAMI (https://<vcenter>:5480) and check the build number, or run 'vpxd -v' on the appliance. Compare against Broadcom's advisory.

Included because

unauthenticated; network-accessible; exploited in the wild; high-value target (hypervisor management)

Action

Patch vCenter to the fixed build listed in Broadcom's advisory. Restrict management network access to vCenter immediately.

Why it matters

vCenter is the control plane for your entire virtual infrastructure. Compromise here means full control of every VM and host.

Attackers can bypass authentication on SharePoint over the network without valid credentials. This is exploited in the wild, and the EPSS score of 0.04 (90th percentile) signals meaningful exploit activity. If your SharePoint is internet-facing or accessible from untrusted network segments, an unauthorized attacker can slip past security controls.

Affected estate

SharePoint admins running on-prem SharePoint farms, particularly those with internet-facing or hybrid deployments

How to check

In Central Administration, check the farm build number under 'Manage servers in this farm.' Compare it to Microsoft's security advisory for CVE-2026-55040.

Included because

unauthenticated; network-accessible; exploited in the wild; common enterprise product; auth bypass

Action

Install the SharePoint security update. Review whether SharePoint is exposed to untrusted networks and add restrictions if it is.

Why it matters

Authentication bypass gives attackers access to your SharePoint content and potentially a foothold into your internal network without needing credentials.

An attacker on your network can authenticate to macOS Screen Sharing without valid credentials. That means full remote desktop access to any affected Mac. This is exploited in the wild. The good news: the attacker needs network access to the Screen Sharing port (5900), so this primarily hits Macs with Screen Sharing enabled on reachable networks.

Affected estate

Mac admins and anyone managing macOS endpoints with Screen Sharing (VNC) enabled

How to check

Run 'sw_vers' to check the macOS version. Run 'sudo launchctl list | grep screensharing' to confirm if Screen Sharing is active. Check your MDM inventory for enabled Remote Management or Screen Sharing profiles.

Included because

authentication bypass; exploited in the wild; common endpoint platform; network-accessible service

Action

Push the latest macOS update via your MDM. Disable Screen Sharing on systems that don't require it.

Why it matters

Unauthenticated Screen Sharing access gives an attacker full remote control of the Mac, including access to files, credentials, and anything on screen.