CISA Adds SharePoint and Check Point SmartConsole Flaws to Known Exploited Vulnerabilities Catalog
The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding the active exploitation of vulnerabilities in Microsoft SharePoint and Check Point Software Technologies SmartConsole.
On July 22, 2026, CISA added CVE-2026-50522 and CVE-2026-16232 to its Known Exploited Vulnerabilities (KEV) catalog. Federal agencies have been instructed to apply mitigations by July 25, 2026, while all organizations are urged to take immediate action due to the widespread exploitation risk.
CVE-2026-50522 resides in Microsoft SharePoint and enables remote attackers to execute arbitrary code by deserializing untrusted data. The flaw received a CVSS v3.1 base score of 9.8 and is rated Critical. A security update addressing the issue was included in Microsoft’s July 14, 2026 Patch Tuesday release. Coordinated disclosure occurred, and no exploitation was known at the time the advisory was published.
CVE-2026-16232 affects the SmartConsole management tool from Check Point Software Technologies. The vulnerability stems from improper authentication, allowing attackers to obtain administrative rights and modify security configurations and policies. Check Point has published a list of IP addresses observed in attacks and is advising customers to investigate potential compromises.
Security researchers note that both vulnerabilities are being actively leveraged in the wild, increasing the urgency for patching across enterprise environments.
Related articles
Check Point Management Products Affected by High-Severity Authentication Bypass Vulnerability CVE-2026-16232 Already Under Active Exploitation
Check Point Software Technologies has disclosed a high-severity vulnerability in its security management products that allows attackers to bypass authentication and gain administrator privileges. The flaw, tracked as CVE-2026-16232, resides in the SmartConsole login process and affects the Management Server when accessed over the network. The company published its security advisory on July 19, 2026, confirming that exploitation has already been observed in the wild. Successful attacks could enable unauthorized changes to security configurations and policies. Impacted software includes R82.10, R82, R81.20, and multiple unsupported versions starting from R77.30. Organizations are urged to investigate potential breaches and apply available mitigations promptly.
Adobe Acrobat Chrome Extension Flaw Enabled Silent Theft of WhatsApp Web Conversations
A vulnerability in the Adobe Acrobat extension for Chrome allowed attackers to silently extract WhatsApp Web conversations, contacts, and account data without any user interaction beyond visiting a malicious page. The issue affected approximately 329 million browser installations and required no password theft or malware infection. Researchers at Guardio named the attack HermeticReader and traced it to an internal messaging flaw that let a hidden iframe execute unverified commands inside the extension. This activated the dormant Hermes integration mechanism, which acted as a bridge to WhatsApp Web and exfiltrated data in plaintext while the user viewed an ordinary webpage. Adobe received the report, fixed the bug in June, and assigned it CVE-2026-48294, classifying it as a UXSS vulnerability that enables cross-site data disclosure. The extension's failure to validate message sources allowed the malicious site to write data to local storage and trigger the integration without warnings.
From Hundreds of Alerts to Proven Vulnerabilities: INFERA AI.SafeCode Unifies Seven Scanners into a Single DevSecOps Pipeline
INFERA AI.SafeCode integrates seven distinct security scanners into one continuous analysis platform that automatically validates findings instead of flooding teams with unconfirmed alerts. The solution combines SAST, SCA, Secrets detection, DAST, AI-driven Pentest agents, Code Fuzzing, and API Fuzzing to deliver proof-of-exploit evidence for high-risk issues. By cross-validating results across engines, the platform reduces false positives and provides developers with actionable tasks that include reproduction steps, stack traces, and one-click AutoFix recommendations directly inside IDEs and Git workflows. Special attention is given to AI-generated code from tools such as GitHub Copilot, Cursor, and Claude, ensuring that rapid development does not introduce unvetted vulnerabilities. The system also maps full attack surfaces, tracks reachability from entry points to vulnerable sinks, and supports compliance requirements including FSTEC orders for critical information infrastructure. MLSecOps capabilities extend coverage to machine-learning pipelines, model configurations, and inference APIs. Overall, INFERA shifts AppSec from reactive alert triage to measurable risk management with clear MTTR metrics and SLA tracking.
Critical wp2shell Vulnerability Chain Exploited in WordPress for Unauthenticated Remote Code Execution and Webshell Deployment
A critical vulnerability chain dubbed wp2shell is being actively exploited against WordPress Core installations, enabling unauthenticated remote code execution and the installation of persistent webshells. The flaws affect versions 7.0.x prior to 7.0.2, 6.9.x prior to 6.9.5, and the 6.8 branch before 6.8.6, with patches now available. Attackers chain CVE-2026-63030 and CVE-2026-60137 through the WordPress REST API batch processing endpoint and an SQL injection in WP_Query via the author__not_in parameter. Observed campaigns involve mass scanning, user enumeration, attempts to read wp-config.php, and deployment of PHP webshells in wp-content/cache that return fake 404 responses. Administrators are urged to update immediately, audit logs for anomalous REST API requests, inspect for unauthorized admin accounts or plugins, and rotate credentials if wp-config.php exposure is suspected.