CISA Adds SharePoint and Check Point SmartConsole Flaws to Known Exploited Vulnerabilities Catalog
The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding the active exploitation of vulnerabilities in Microsoft SharePoint and Check Point Software Technologies SmartConsole.
On July 22, 2026, CISA added CVE-2026-50522 and CVE-2026-16232 to its Known Exploited Vulnerabilities (KEV) catalog. Federal agencies have been instructed to apply mitigations by July 25, 2026, while all organizations are urged to take immediate action due to the widespread exploitation risk.
CVE-2026-50522 resides in Microsoft SharePoint and enables remote attackers to execute arbitrary code by deserializing untrusted data. The flaw received a CVSS v3.1 base score of 9.8 and is rated Critical. A security update addressing the issue was included in Microsoft’s July 14, 2026 Patch Tuesday release. Coordinated disclosure occurred, and no exploitation was known at the time the advisory was published.
CVE-2026-16232 affects the SmartConsole management tool from Check Point Software Technologies. The vulnerability stems from improper authentication, allowing attackers to obtain administrative rights and modify security configurations and policies. Check Point has published a list of IP addresses observed in attacks and is advising customers to investigate potential compromises.
Security researchers note that both vulnerabilities are being actively leveraged in the wild, increasing the urgency for patching across enterprise environments.
Related articles
Code Signing Myths: Why a Valid Digital Signature Does Not Equal File Safety
Digital signatures confirm only that a file was issued by a specific publisher at a given time and remained unchanged afterward. They do not verify current safety, the legitimacy of the current holder, or whether the private key was stolen months earlier. Attackers obtain legitimate certificates through build-system leaks, supply-chain compromises such as the 2019 ASUS ShadowHammer incident, or weak reseller validation. Expired certificates remain usable because verification can be performed at the timestamp recorded by an RFC 3161 TSA token rather than the current system clock. Signature hashes in Authenticode deliberately exclude the checksum field, certificate table, and attribute certificate table, allowing limited tampering that older WinVerifyTrust implementations did not fully block. Revocation checks are soft by default, and revocation dates can leave an exploitation window open. Organizations should enforce publisher thumbprint allow-lists in WDAC or AppLocker and store signing keys exclusively in HSMs.
Attackers Exploit Critical Langflow and Ruby on Rails Flaws for Credential Theft and C2 Infrastructure
Active exploitation has been confirmed for CVE-2026-0768 in Langflow and CVE-2026-66066 in Ruby on Rails. Attackers first focus on reconnaissance and secret exfiltration before establishing command-and-control channels, with potential escalation to remote code execution. In Langflow the flaw allows arbitrary Python code execution as root due to insufficient input validation, enabling attackers to dump environment variables and locate cloud credentials. The Ruby on Rails issue, tracked as KindaRails2Shell, stems from an arbitrary file read triggered when Active Storage processes untrusted image uploads with libvips, exposing secret_key_base and other sensitive keys. Observed campaigns show traffic originating from Russia against Langflow instances and activity targeting canaries in Singapore, Israel, and the United Kingdom for Rails deployments. Defenders are advised to inventory public instances, apply the latest patches, rotate exposed secrets, and monitor for suspicious file reads and C2 communications.
Critical Vulnerabilities in PaperCut NG and PaperCut MF Exploited in the Wild
PaperCut Software has disclosed two serious vulnerabilities in its printing management solutions PaperCut NG and PaperCut MF. The issues were detailed in an advisory published on August 27, 2026, followed by emergency patches. Exploitation has already been confirmed in customer environments. CVE-2026-81578 stems from improper access controls in the web management interface, allowing unauthenticated remote changes to system settings. CVE-2026-82078 involves insecure dynamic class loading in database connections, enabling arbitrary Java bytecode execution with server privileges when combined with the first flaw. CVSS scores are 9.4 (Critical) and 8.8 (High) respectively, and both vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities Catalog.
Positive Technologies Develops Dynamic Crawler for Single-Page Applications in PT BlackBox Scanner
Positive Technologies engineers have detailed the development of a dynamic crawler for their PT BlackBox DAST scanner to handle modern single-page applications built with frameworks such as React and Vue. The crawler must discover attack surface elements that only appear after user interactions because static parsing of initial DOM fails on SPAs where navigation occurs without URL changes. Key challenges include identifying interactive elements whose handlers are attached via JavaScript, detecting state changes after clicks or inputs, and managing combinatorial explosion of states caused by independent UI toggles. The team models the application as a labeled transition system and defines state equivalence using sets of 64-bit fingerprints of interactive elements rather than raw HTML similarity or URL values. This equivalence relation satisfies reflexivity, determinism from external observations, cheap hash-based comparison, slower growth than action count, and preservation of enabled actions across equivalent states. The approach allows the crawler to visit representatives of equivalence classes instead of every reachable state, keeping scans finite and practical within action budgets of several thousand interactions.