CISA KEV Alert: SharePoint & Check Point SmartConsole Flaws Need Urgent Patching

Federal agencies and enterprises worldwide face a tight compliance window this week as CISA added two significant vulnerabilities affecting Microsoft SharePoint and Check Point SmartConsole to its Known Exploited Vulnerabilities (KEV) catalog on July 22, 2026.

With a remediation deadline of July 25, 2026, security teams have precious little time to assess exposure and apply mitigations under the newly enforced BOD 26-04 directive.

SharePoint & Check Point SmartConsole Flaws

CVE-2026-50522 strikes at the heart of Microsoft SharePoint’s data handling architecture. Classified under CWE-502 (Deserialization of Untrusted Data), the vulnerability allows an unauthorized attacker to execute arbitrary code over a network simply by sending maliciously crafted serialized objects to a vulnerable SharePoint instance.

Deserialization vulnerabilities have long been a favorite entry point for sophisticated threat actors because they often bypass traditional authentication controls entirely.

When an application deserializes data without proper validation, attackers can smuggle in executable payloads disguised as legitimate objects, effectively turning trusted internal processes against the system itself.

Given SharePoint’s ubiquity in enterprise document management and collaboration workflows, the attack surface here is substantial. Organizations running on-premises SharePoint Server deployments face particular risk, since internet-facing instances become prime targets for automated exploitation attempts.

The second entry, CVE-2026-16232, targets Check Point’s SmartConsole management interface, a tool many organizations rely on to administer their firewall and security infrastructure.

Tagged under CWE-287 (Improper Authentication), this flaw is arguably more alarming in its simplicity: an unauthenticated remote attacker can obtain an application login token and leverage it to gain full administrative privileges.

Think of it like a hotel keycard system where the master key can be duplicated by anyone standing near the front desk, without ever checking in. That’s the practical risk here: attackers don’t need credentials, phishing lures, or social engineering. They just need network access to the vulnerable component.

Because SmartConsole governs security policy enforcement across an organization’s network perimeter, compromise here doesn’t just expose data; it can hand attackers the ability to reconfigure firewall rules, disable protections, or pivot laterally with the trust of a legitimate administrator.

“What makes this week’s KEV additions particularly urgent isn’t just the technical severity it’s the convergence of two vulnerabilities in tools that sit at critical trust boundaries. SharePoint holds the data; SmartConsole holds the keys to the kingdom. When deserialization flaws and authentication bypasses land in the same news cycle, defenders should treat it as a signal that adversaries are actively probing enterprise infrastructure at multiple layers simultaneously,” says a senior threat intelligence analyst tracking the KEV catalog trends.

CISA’s Binding Operational Directive 26-04

CISA’s Binding Operational Directive 26-04 shifts the patching calculus by requiring risk-based prioritization rather than blanket timelines. For these two CVEs, agencies and BOD-bound entities must:

Apply vendor-issued patches or mitigations immediately.
Evaluate internet exposure for each affected asset, prioritizing internet-facing SharePoint and SmartConsole instances.
Follow CISA’s Forensics Triage Requirements if compromise indicators are found.
Discontinue use of affected products if no mitigation path exists, particularly for cloud-hosted instances per BOD 26-04’s cloud services guidance.

Neither vulnerability currently shows confirmed ransomware campaign association, but “unknown” status shouldn’t breed complacency; historical KEV entries often gain ransomware linkage weeks after initial disclosure. Organizations still running unpatched SharePoint or SmartConsole deployments should treat the July 25 deadline as a hard floor, not a suggestion.