What Changed
On July 22, CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-16232, an authentication bypass in Check Point SmartConsole, and CVE-2026-50522, a deserialization flaw in on-premises Microsoft SharePoint Server. Federal civilian agencies must remediate under BOD 26-04.
Check Point SmartConsole (CVE-2026-16232)
The flaw lets an attacker obtain an administrator application token on a Check Point Security Management Server or Multi-Domain Server. Check Point says exploitation requires unrestricted Trusted Clients and an internet-reachable management IP. Defenders should search audit logs for Authentication method: application token logins they cannot explain.
SharePoint Server (CVE-2026-50522)
watchTowr reports that attackers began exploiting this unauthenticated remote code execution flaw on July 20, hours after public exploit code appeared, and are using it to steal IIS machine keys for long-term access. Defused separately reported traffic it believes targeted the bug on July 17. Microsoft shipped fixes in its July 14 updates. Censys counts about 1,500 internet-facing on-premises SharePoint hosts, mostly SharePoint 2019.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
What To Verify First
- Patch every on-premises SharePoint farm node and every Check Point management server.
- For SharePoint, confirm AMSI integration is enabled, hunt for intrusion artifacts, and then rotate IIS machine keys. Patching alone does not revoke stolen keys.
- For Check Point, restrict Trusted Clients and remove management interfaces from the internet.
What Teams May Be Underestimating
Both entries are post-exploitation persistence problems as much as patch problems. A stolen machine key or a forged admin token survives the update, so the cleanup step matters as much as the fix.
Source Context
This item was rebuilt from the following primary sources and original reporting:
- CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (July 22, 2026)
- BleepingComputer: Check Point patches SmartConsole zero-day exploited in attacks
- Help Net Security: Another SharePoint RCE exploited: Patch, then rotate your machine keys (CVE-2026-50522)
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Thursday’s brief: Cisco email gateways under attack, then PAN-OS, Nextcloud and AhsayCBS
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
