On July 22, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two critical security flaws to its Known Exploited Vulnerabilities (KEV) catalog, a step that signals active, ongoing exploitation. The vulnerabilities — CVE-2026-50522 in Microsoft SharePoint Server and CVE-2026-16232 in Check Point SmartConsole — carry near-maximum severity scores and sit at the heart of enterprise collaboration and network security. Agencies and companies alike are now under pressure to move beyond routine patching cycles and treat these fixes as emergency work.

What Got Flagged — and Why the KEV Label Changes Everything

The KEV catalog is CISA's list of vulnerabilities that have crossed the line from theoretical risk to documented attack tool. A CVSS score alone can't convey that urgency; the KEV designation means defenders should assume adversaries have working exploits, operational tradecraft, and active interest.

The two new entries target very different infrastructure, but both can hand attackers an outsized advantage.

CVE-2026-50522 is a deserialization of untrusted data flaw in on-premises Microsoft SharePoint Server. Rated critical with a CVSS v3.1 score of 9.8, it allows remote code execution with low attack complexity and no user interaction. An attacker who reaches the server can run arbitrary code within the SharePoint process, potentially gaining access to sensitive documents, service accounts, SQL databases, and Active Directory integrations. The vulnerability affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Fixes were delivered in the July 2026 security updates; for the Subscription Edition, the correcting patch is KB5002882, bringing the build to 16.0.19725.20434 or later.

CVE-2026-16232 is an improper authentication vulnerability in Check Point SmartConsole, part of the Security Management and Multi-Domain Management suites. With a CVSS score of 9.3, it lets attackers bypass authentication under certain conditions, potentially granting control over firewall policies, VPNs, and logging. Check Point has confirmed active exploitation, especially where management services are exposed directly to the internet without IP restrictions. Affected versions include R81.10, R81.20, R82, R82.10, and possibly earlier releases. The vendor has released a Jumbo Hotfix to neutralize the attack vector.

Who Needs to Act First

The urgency is not uniform. Three groups should move fastest.

Federal civilian agencies are bound by Binding Operational Directive 26-04. Under that directive, any KEV-listed vulnerability on a publicly exposed asset that grants total control post-exploitation must be patched within aggressive timelines — and agencies must also determine whether the system was compromised before the patch was applied.

SharePoint administrators at organizations of any size, particularly those with internet-facing farms, partner portals, or exposed management interfaces. The SharePoint flaw's deserialization nature means that a single vulnerable server can become a pivot point for lateral movement. And because SharePoint Server 2016 and 2019 reached the end of their extended support on July 14, 2026 — the very day the patch shipped — remaining on those versions after this patch is a game of roulette: future vulnerabilities will have no guaranteed fixes.

Check Point customers who rely on Security Management or Multi-Domain Management. If your SmartConsole or management server is reachable from the internet — even through a VPN that is broadly accessible — the risk is acute. The observed exploitation has been linked to exactly that kind of exposure.

How We Arrived at This Double Threat

The timing is rough. SharePoint's July 2026 update cycle coincided with the sunset of two major on-premises versions, a planned milestone that suddenly became a forced migration trigger. For years, organizations nursed legacy SharePoint farms because they hosted critical workflows and were tightly integrated with line-of-business applications. The KEV listing now makes it much harder to justify delaying upgrades.

CISA's own approach to vulnerability management also sharpened in 2026. BOD 26-04 refocused federal remediation on real-world risk: active exploitation, exploit automation, and total control impact. That model elevated the KEV catalog from a watchlist to a live operational mandate. The practical message for any enterprise is that a KEV entry should bypass normal change-control debates and go straight to an emergency patching window.

On the Check Point side, the vulnerability underscores a persistent industry problem: management planes that were never designed for internet exposure end up there anyway — for convenience, remote administration, or by accident. The exploit activity observed by CISA reinforces a blunt truth: internet-facing security management interfaces are a magnet for attackers.

Immediate Steps: Patch, Then Hunt for Signs of Breach

A patch alone does not undo damage that may have already occurred. Here is a concrete action plan for each product.

For Microsoft SharePoint

  1. Identify every SharePoint farm in your estate. This includes production, disaster recovery, test, departmental shadow servers, and any published extranet or partner portal. Attackers often find the forgotten instance.
  2. Assess exposure. Determine whether any of those farms are directly internet-reachable, presented through a reverse proxy, accessible from VPN clients with broad privileges, or integrated with federated identity systems that could be abused after credential theft.
  3. Deploy the July 2026 security update. For each affected version, confirm the post-patch build number:
    - SharePoint Enterprise Server 2016: 16.0.5561.1001 or later
    - SharePoint Server 2019: 16.0.10417.20175 or later
    - SharePoint Server Subscription Edition: 16.0.19725.20434 or later (KB5002882)
    In a multi-server farm, every role must reach the fixed build.
  4. Run the SharePoint Products Configuration Wizard (or the equivalent PSConfig command) on each server. An installed but unconfigured patch offers no protection.
  5. Validate farm health. Test central administration, content databases, search, user profiles, authentication, and any custom solutions. Degraded functionality after patching is a common headache and often fixable, but skipping validation leaves blind spots.
  6. Hunt for pre-patch compromise. Focus on:
    - IIS logs for unusual patterns (new .asp or .ashx files, high volumes of failed logins)
    - Newly created local or domain user accounts with high privileges
    - Unscheduled task creations or changes
    - Suspicious outbound connections from SharePoint servers
    - Machine key extraction (attackers may attempt to steal these for token forgery)
    If any sign of compromise is found, rotate SharePoint machine keys, service account credentials, and review the entire trust chain.

For Check Point Security Management

  1. Deploy the current Jumbo Hotfix provided by Check Point. This addresses the authentication bypass directly.
  2. Lock down management access. The most effective immediate step is to restrict SmartConsole and GUI client access to trusted IP addresses or subnets only. Ideally, management interfaces should never be directly exposed to the internet. Use a dedicated administrative network, a jump host with tight controls, and enforce multi-factor authentication where possible.
  3. Audit recent management-plane activity. Check for:
    - Unexpected policy installations or rule changes
    - New administrative accounts or privilege elevations
    - Modifications to VPN settings, object definitions, or gateway configurations
    - Evidence that logging or alerting was disabled or tampered with
    If changes cannot be accounted for, assume the management plane may have been under adversary control and initiate a full incident response.

The Bigger Picture: Management Planes Are Now a Prime Target

These two KEV additions are not isolated events. They reflect a pattern: attackers are increasingly targeting the administrative layers that defend or connect an enterprise. When SharePoint is compromised, it's not just a document store — it's a stepping stone into identity systems, databases, and internal networks. When a firewall manager is breached, the attacker can alter the very rules meant to stop them.

For SharePoint, the looming problem is the newly expired support for 2016 and 2019. The July patch plugs this particular hole, but it's likely the last free safety net. Organizations that cannot migrate quickly should at the very least firewall off legacy farms from all but essential internal access and monitor them aggressively.

For Check Point, the fix is technical but also architectural. Direct internet exposure of any management service must become a board-level unacceptable risk. The good news: both vendors responded quickly, and CISA's spotlight gives IT teams the leverage to get emergency fixes deployed without the usual red tape.

What comes next is not just about these two CVEs. It's about a risk-based patching culture that treats active exploitation as the ultimate priority signal — and about recognizing that even the most trusted internal servers can turn hostile if they're left exposed for too long.