CISA Confirms Active Exploitation of Critical Check Point and Microsoft SharePoint Flaws

-


 Two enterprise-facing vulnerabilities added to CISA’s Known Exploited Vulnerabilities Catalog require urgent patching, exposure review and forensic triage.

On 22 July 2026, the U.S. Cybersecurity and Infrastructure Security Agency added two serious vulnerabilities to its Known Exploited Vulnerabilities Catalog after confirming evidence of active exploitation:

  • CVE-2026-16232 — Check Point SmartConsole authentication bypass.
  • CVE-2026-50522 — Microsoft SharePoint deserialization vulnerability.

Both vulnerabilities affect high-value enterprise infrastructure. One can provide administrative control over security-management systems, while the other can enable unauthenticated remote code execution on vulnerable SharePoint servers. CISA set 25 July 2026 as the remediation deadline for affected U.S. federal civilian agencies, demonstrating the urgency attached to both flaws.

1. Check Point SmartConsole Authentication Bypass

CVE: CVE-2026-16232
Type: Improper authentication
Affected technology: Check Point Security Management and Multi-Domain Management
Check Point severity: 9.3
Exploitation status: Confirmed active exploitation

The vulnerability affects the SmartConsole authentication process. An unauthenticated remote attacker may obtain an application login token and use it to authenticate with full administrative privileges.

Successful exploitation could allow an attacker to modify security policies, change security configurations and potentially weaken protections across systems managed through the affected Check Point environment.

Check Point reported that exploitation requires the Management Server to be reachable from the internet and configured without effective Trusted Client restrictions. The company stated that the activity affected a small number of customers using this specific exposure configuration. Smart-1 Cloud customers were already protected.

Affected Check Point versions

The affected products include Quantum Security Management and Multi-Domain Security Management running:

  • R82.10 with Jumbo Hotfix Take 36 or earlier
  • R82 with Jumbo Hotfix Take 118 or earlier
  • R81.20 with Jumbo Hotfix Take 158 or earlier
  • R81.10 and several older releases

Organizations should confirm their exact installed version against the current Check Point advisory rather than relying only on the general version list.

Check Point’s recommended response

Check Point advises customers to:

  1. Install the latest Jumbo Hotfix released on 22 July 2026.
  2. Restrict Trusted Clients to approved IP addresses and subnets.
  3. Protect management access through firewall controls.
  4. Prevent direct internet exposure of the Management Server.
  5. Confirm that implied rules for management control connections are properly configured.

Published network indicators

Check Point reported the following IP addresses in connection with the observed exploitation:

  • 151.241.99[.]207
  • 151.241.99[.]233
  • 158.62.198[.]182
  • 192.142.10[.]99
  • 139.28.37[.]250
  • 194.213.18[.]137

Organizations should review historical firewall, VPN, management-server and authentication logs for communication involving these indicators. Their presence should trigger investigation, but it should not automatically be treated as proof of compromise without supporting evidence.

2. Microsoft SharePoint Remote Code Execution

CVE: CVE-2026-50522
Type: Deserialization of untrusted data
Affected technology: On-premises Microsoft SharePoint Server
CVSS score: 9.8 Critical
Exploitation status: Confirmed active exploitation

Microsoft describes CVE-2026-50522 as a deserialization vulnerability in Microsoft Office SharePoint that allows an unauthorized attacker to execute code remotely over a network.

The vulnerability requires no prior authentication and no user interaction. Its CVSS vector indicates low attack complexity and potentially complete impact on confidentiality, integrity and availability.

Affected SharePoint products

The affected products include:

  • Microsoft SharePoint Enterprise Server 2016
  • Microsoft SharePoint Server 2019
  • Microsoft SharePoint Server Subscription Edition

Microsoft released security updates for the affected SharePoint versions on 14 July 2026. The corrected builds include SharePoint Server 2016 build 16.0.5561.1001, SharePoint Server 2019 build 16.0.10417.20175 and SharePoint Server Subscription Edition build 16.0.19725.20434.

Why these vulnerabilities matter

These are not theoretical vulnerabilities awaiting possible exploitation.

They have been added to CISA’s Known Exploited Vulnerabilities Catalog because exploitation has been observed in real environments.

The Check Point vulnerability targets infrastructure used to define and administer enterprise security policies. Administrative access could allow an attacker to change the controls intended to protect the wider network.

The SharePoint vulnerability affects a widely used collaboration and document-management platform. Successful exploitation could provide remote access to the server, expose organizational information, support persistence or create a path toward additional internal systems.

What organizations should do now

For Check Point environments

  • Identify all Security Management and Multi-Domain Management servers.
  • Confirm whether management interfaces are reachable from the internet.
  • Install the latest Jumbo Hotfix.
  • Restrict Trusted Clients and management access to approved networks.
  • Review application-token issuance and administrative login activity.
  • Examine recent changes to security policies and administrator accounts.
  • Search network logs for the published indicators.
  • Preserve relevant logs before normal retention processes overwrite them.

For Microsoft SharePoint environments

  • Identify all on-premises SharePoint Server 2016, 2019 and Subscription Edition deployments.
  • Verify that the July 2026 Microsoft security updates have been installed successfully.
  • Confirm that the SharePoint farm configuration process completed after installation.
  • Review IIS, SharePoint, Windows event and endpoint-security logs.
  • Investigate unexplained child processes launched by SharePoint or IIS worker processes.
  • Examine recently created or modified web-accessible files.
  • Review new accounts, privilege changes and unusual authentication activity.
  • Preserve disk, memory and log evidence where compromise is suspected.

CISA’s required action specifically includes applying vendor mitigations and conducting forensic triage in line with its current risk-based patching guidance.

Detection must continue after patching

Applying updates closes the known vulnerability, but it does not confirm that an organization was not compromised before patching.

Organizations with exposed Check Point management infrastructure or internet-facing SharePoint servers should combine remediation with retrospective investigation.

The review should establish:

  • Whether the vulnerable system was externally reachable.
  • How long it remained exposed.
  • Whether suspicious authentication or process activity occurred.
  • Whether policies, accounts, files or configurations changed.
  • Whether the attacker established persistence.
  • Whether the incident extended to other systems.

This distinction is essential: patching prevents future exploitation, while forensic triage determines whether exploitation may already have occurred.

Final assessment

This is the strongest verified technical warning from 22 July 2026 because it is:

  • Confirmed by a national cybersecurity authority.
  • Supported by advisories and updates from the affected vendors.
  • Based on active exploitation rather than theoretical risk.
  • Relevant to enterprise security administration and collaboration infrastructure.
  • Focused on technical risk without unsupported attribution.

Organizations operating affected Check Point or Microsoft SharePoint infrastructure should treat this as an immediate operational priority.

Actively exploited vulnerabilities require more than patching. They require exposure assessment, forensic review and evidence-led confirmation that trust has not already been compromised.

Official References

Cybersecurity and Infrastructure Security Agency (CISA)
CISA Adds Two Known Exploited Vulnerabilities to Catalog — 22 July 2026
https://www.cisa.gov/news-events/alerts/2026/07/22/cisa-adds-two-known-exploited-vulnerabilities-catalog

CISA Known Exploited Vulnerabilities Catalog
https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Check Point Security Advisory
Active Exploitation of Check Point SmartConsole Authentication Bypass — CVE-2026-16232
https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-check-point-smartconsole-authentication-bypass-cve-2026-16232/

NIST National Vulnerability Database
CVE-2026-16232 — Check Point SmartConsole Authentication Bypass
https://nvd.nist.gov/vuln/detail/CVE-2026-16232
CVE-2026-50522 — Microsoft SharePoint Remote Code Execution
https://nvd.nist.gov/vuln/detail/CVE-2026-50522

Microsoft Security Response Center
CVE-2026-50522 — Microsoft SharePoint Remote Code Execution Vulnerability
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522

Microsoft SharePoint Server Security Updates — 14 July 2026
SharePoint Server 2016 — KB5002891
https://support.microsoft.com/en-us/servicing/office/update/2026/5002891
SharePoint Server 2019 — KB5002883
https://support.microsoft.com/en-us/servicing/office/update/2026/5002883
SharePoint Server Subscription Edition — KB5002882
https://support.microsoft.com/en-us/servicing/office/update/2026/5002882

Comments

Post a Comment

Popular posts from this blog

Introduction To Big Data Forensics

-
Image
Introduction Big Data forensics is a new type of forensics, just as Big Data is a new way of solving the challenges presented by large, complex data. Thanks to the growth in data and the increased value of storing more data and analyzing it fast—Big Data solutions have become more common and more prominently positioned within organizations. As such, the value of Big Data systems has grown, often storing data used to drive organizational strategy, identify sales, and many different modes of electronic communication. The forensic value of such data is obvious: if the data is useful to an organization, then the data is valuable to an investigation of that organization. The information in a Big Data system is not only inherently valuable, but the data is most likely organized and analyzed in such a way to identify how the organization treated the data. Big Data forensics is the forensic collection and analysis of Big Data systems. Traditional computer forensics typically foc...
Read more

CYBER SECURITY: Improving Cyber Defense Through Coherent Joint Red Team and Blue Team

-
Image
CYBER SECURITY:   Improving Cyber Defense Through Coherent Joint Red Team and Blue Team by David Mugisha,  Student of  Ms.Digital Forensics and Information Security (Gujarat Forensic Sciences University) Abstract Over the years, the investments in security moved from nice to have to must have, and now organizations around the globe are realizing how important it is to continually invest in security. This investment will ensure that the company stays competitive in the market. Failure to properly secure their assets could lead to irreparable damage, and in some circumstances could lead to bankruptcy. Due to the current threat landscape, investing only in protection isn't enough. Organizations must enhance their overall security posture. This means that the investments in protection, detection, and response must be aligned. Due to the emerging threats and cyber security challenges, it is necessary to change the methodology from prevent breach to ass...
Read more

Digital Forensics: Investigation VS Security

-
Image
Digital Forensics: Investigation VS Security  by David Mugisha,  Student of  Ms.Digital Forensics and Information Security (Gujarat Forensic Sciences University) Abstract : The past decade has seen previously unimagined advances in technology, and although those developments have benefited individuals and businesses alike, they have also become tools for fraudsters and cyber criminals to steal money and data, and avoid detection. Hackers use technology to hide their illicit activities and to move funds across jurisdictions and around the globe. Their operations are complex and they have significant resources to help them evade detection. This means that those tasked with investigating cyber criminal activity have had to keep pace. We are seeing a new breed of investigators, the digital forensic practitioner, Cyber Security professionals who traces these criminals and their activities. As with other types of evidence, the courts make no presumption tha...
Read more