CISA Adds Critical Vulnerabilities to Known Exploited Vulnerabilities Catalog
Executive Summary
On July 22, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2026-16232 and CVE-2026-50522. CVE-2026-16232 is an authentication bypass vulnerability in Check Point SmartConsole, allowing unauthenticated remote attackers to gain administrative access and modify security policies. CVE-2026-50522 is a deserialization vulnerability in Microsoft SharePoint, enabling unauthorized remote code execution without authentication. Both vulnerabilities are actively exploited, posing significant risks to organizations using these platforms.
The inclusion of these vulnerabilities in the KEV Catalog underscores the increasing trend of attackers targeting critical infrastructure through widely used enterprise applications. Organizations are urged to prioritize the remediation of these vulnerabilities to mitigate potential breaches and maintain compliance with security directives.
Why This Matters Now
The active exploitation of these vulnerabilities highlights the urgent need for organizations to assess and secure their Check Point and Microsoft SharePoint deployments. Immediate action is required to prevent unauthorized access and potential data breaches.
Attack Path Analysis
Attackers exploited vulnerabilities in Microsoft SharePoint and Check Point SmartConsole to gain unauthorized access, escalate privileges, move laterally within the network, establish command and control channels, exfiltrate sensitive data, and disrupt operations.
Kill Chain Progression
Initial Compromise
Description
Attackers exploited CVE-2026-50522 in Microsoft SharePoint, allowing unauthenticated remote code execution via deserialization of untrusted data.
Related CVEs
CVE-2026-16232
CVSS 9.1An authentication bypass vulnerability in Check Point SmartConsole allows unauthenticated remote attackers to obtain administrative privileges, enabling modification of security policies and configurations.
Affected Products:
Check Point Quantum Security Management – R82.10 with Jumbo Hotfix Take 36 or below, R82 with Jumbo Hotfix Take 118 or below, R81.20 with Jumbo Hotfix Take 158 or below, R81.10, R81, R80.30, R80.20, R80.10, R80, R77.30
Check Point Multi-Domain Security Management – R82.10 with Jumbo Hotfix Take 36 or below, R82 with Jumbo Hotfix Take 118 or below, R81.20 with Jumbo Hotfix Take 158 or below, R81.10, R81, R80.30, R80.20, R80.10, R80, R77.30
Exploit Status:
exploited in the wildCVE-2026-50522
CVSS 9.8Deserialization of untrusted data in Microsoft Office SharePoint allows unauthorized attackers to execute code over a network.
Affected Products:
Microsoft SharePoint Server 2019 – 16.0.0 up to 16.0.10417.20175
Microsoft SharePoint Server 2016 – 16.0.0 up to 16.0.5561.1001
Microsoft SharePoint Server Subscription Edition – 16.0.0 up to 16.0.19725.20434
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Valid Accounts
Command and Scripting Interpreter
Abuse Elevation Control Mechanism
Impair Defenses
Data Destruction
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Access Privileges
Control ID: 500.07
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Identity and Access Management
Control ID: Identity Pillar
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
Federal agencies face critical vulnerability exploitation risks in Check Point SmartConsole and SharePoint systems, requiring immediate KEV Catalog compliance remediation.
Financial Services
Banking institutions vulnerable to authentication bypass and deserialization attacks affecting network security controls and customer data protection compliance frameworks.
Health Care / Life Sciences
Healthcare organizations risk HIPAA violations through SharePoint exploitation and network segmentation failures, threatening patient data and operational continuity.
Information Technology/IT
IT service providers managing Check Point and SharePoint infrastructure face lateral movement risks, requiring zero trust segmentation and threat detection capabilities.
Sources
- CISA Adds Two Known Exploited Vulnerabilities to Cataloghttps://www.cisa.gov/news-events/alerts/2026/07/22/cisa-adds-two-known-exploited-vulnerabilities-catalogVerified
- Check Point Security Advisory: Authentication Bypass Vulnerability in SmartConsolehttps://support.checkpoint.com/results/sk/sk185169Verified
- Microsoft Security Update Guide: CVE-2026-50522https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it would likely limit the attacker's ability to exploit vulnerabilities, escalate privileges, and move laterally within the network, thereby reducing the overall blast radius.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to exploit the SharePoint vulnerability would likely be constrained, limiting unauthorized access to the compromised workload.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges would likely be limited, reducing the scope of unauthorized administrative access.
Control: East-West Traffic Security
Mitigation: The attacker's lateral movement would likely be constrained, limiting access to additional systems and resources.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish command and control channels would likely be limited, reducing persistent access to compromised systems.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's data exfiltration efforts would likely be constrained, limiting unauthorized data transfer to external servers.
The attacker's ability to disrupt operations would likely be limited, reducing the potential for further exploitation or denial of service.
Impact at a Glance
Affected Business Functions
- Network Security Management
- Document Management
- Collaboration Platforms
Estimated downtime: 3 days
Estimated loss: $500,000
Potential exposure of sensitive corporate documents and security configurations.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to limit lateral movement and enforce least privilege access.
- • Deploy Inline IPS (Suricata) to detect and prevent exploitation of known vulnerabilities.
- • Utilize Threat Detection & Anomaly Response systems to identify and respond to suspicious activities.
- • Enforce Egress Security & Policy Enforcement to control outbound traffic and prevent data exfiltration.
- • Ensure regular patching and updating of systems to mitigate known vulnerabilities.
