# CISA adds Check Point and SharePoint vulns to KEV catalog

Published: 2026-07-22 · Severity: high · Sectors: government-national, defense
Canonical: https://vorant.io/reports/94ed1cbb-4cdc-5901-9ff9-fbad58f2a494/cisa-adds-check-point-and-sharepoint-vulns-to-kev-catalog

> CISA added CVE-2026-16232 in Check Point SmartConsole and CVE-2026-50522 in Microsoft SharePoint to its Known Exploited Vulnerabilities catalog based on active exploitation.

CISA has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation in the wild. CVE-2026-16232 is an improper authentication vulnerability in Check Point SmartConsole that allows attackers to bypass authentication controls. CVE-2026-50522 is a deserialization of untrusted data flaw in Microsoft SharePoint that can lead to remote code execution and full system compromise.

These vulnerabilities are now flagged for federal agencies under Binding Operational Directive (BOD) 26-04, which requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of high-risk vulnerabilities listed in the KEV Catalog when they affect publicly exposed assets that provide total control post-exploitation. While BOD 26-04 applies specifically to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and treat KEV-listed vulnerabilities as priority remediation targets. Organizations should verify whether systems were compromised before patching was applied.

## Mentioned in this report

- Vulnerabilities: CVE-2026-16232 (KEV), CVE-2026-50522 (KEV)

## Detection guidance (public sample)

### SharePoint IIS Worker Process Spawning Shell or LOLBin

ATT&CK: T1190

w3wp.exe running a SharePoint application pool spawning a command shell or script/download LOLBin, consistent with post-exploitation of a SharePoint deserialization RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SharePoint IIS Worker Process Spawning Shell or LOLBin
description: Detects the IIS worker process of a SharePoint application pool spawning
  cmd, PowerShell, script hosts or download LOLBins. This is the typical post-exploitation
  pattern after a SharePoint deserialization RCE gives code execution in w3wp.exe.
  Generalises on the parent/child relation, not any campaign-specific payload.
tags:
- attack.initial-access
- attack.execution
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    ParentCommandLine|contains: SharePoint
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \cscript.exe
    - \wscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \rundll32.exe
    - \regsvr32.exe
  condition: selection
falsepositives:
- Custom SharePoint solutions or farm scripts that deliberately shell out from the
  web application pool
level: high
id: 90eac2d5-bc02-5441-8299-aadd39310fd9
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/07/22/cisa-adds-two-known-exploited-vulnerabilities-catalog
```

### IIS Worker Process Writing Web Shell Files to SharePoint LAYOUTS Directory

ATT&CK: T1190

w3wp.exe creating .aspx/.ashx/.asmx files under the SharePoint TEMPLATE\LAYOUTS directory, a common web shell drop location after exploiting SharePoint. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: IIS Worker Process Writing Web Shell Files to SharePoint LAYOUTS Directory
description: Detects w3wp.exe creating server-side script files in the SharePoint
  TEMPLATE\LAYOUTS directory. Legitimate content is deployed by installers or farm
  solution timer jobs rather than the web application pool, so this suggests a web
  shell dropped after remote code execution.
tags:
- attack.initial-access
- attack.persistence
- attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \w3wp.exe
    TargetFilename|contains: \TEMPLATE\LAYOUTS\
    TargetFilename|endswith:
    - .aspx
    - .ashx
    - .asmx
  condition: selection
falsepositives:
- Custom SharePoint farm solutions that write pages into LAYOUTS at runtime
level: high
id: 3da0c9ff-33f4-562a-b882-aa5a607198b3
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/07/22/cisa-adds-two-known-exploited-vulnerabilities-catalog
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/alerts/2026/07/22/cisa-adds-two-known-exploited-vulnerabilities-catalog

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/94ed1cbb-4cdc-5901-9ff9-fbad58f2a494/cisa-adds-check-point-and-sharepoint-vulns-to-kev-catalog.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup