CISA Adds SharePoint and Check Point Flaws to Exploited-Vulnerability List
CISA says CVE-2026-50522 in Microsoft SharePoint and CVE-2026-16232 in Check Point SmartConsole have evidence of active exploitation, making patching and compromise checks urgent for exposed systems.
Quick takeaways
- CISA added CVE-2026-16232 for Check Point SmartConsole and CVE-2026-50522 for Microsoft SharePoint to its Known Exploited Vulnerabilities Catalog.
- The warning is aimed at federal agencies, but CISA encourages all organisations to prioritise KEV remediation when there is evidence of active exploitation.
- A VPN can reduce exposure for private admin access, but it cannot patch a vulnerable SharePoint or security-management server.
What happened?
CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog on 22 July 2026, citing evidence of active exploitation. The entries are CVE-2026-16232, a Check Point SmartConsole improper authentication vulnerability, and CVE-2026-50522, a Microsoft SharePoint deserialisation of untrusted data vulnerability.
CISA's alert says these kinds of vulnerabilities are a frequent attack vector for malicious cyber actors. Its Binding Operational Directive applies to US federal civilian agencies, but the agency also encourages all organisations to use the KEV catalog for risk-based vulnerability management.
Why it matters
SharePoint and security-management tooling are not niche targets. They often hold internal documents, authentication paths, admin workflows or trusted network positions. When a vulnerability reaches CISA's exploited list, the issue is no longer theoretical: defenders should assume attackers are looking for exposed systems.
For small businesses and IT teams, the important distinction is between patching and hiding. Reducing internet exposure is useful, but a vulnerable system may still be reachable by partners, remote staff, compromised accounts or attackers already inside the environment.
What you can do now
If you manage Microsoft SharePoint or Check Point SmartConsole, check vendor guidance, patch status and whether the affected systems are exposed to the internet. Prioritise systems that grant broad access, hold sensitive documents or sit on privileged networks.
After patching, review logs and authentication events for suspicious access before assuming the problem is solved. CISA's BOD 26-04 guidance highlights the need to check whether threat actors compromised a system before the patch was applied when high-risk exploited vulnerabilities are involved.
Where a VPN helps — and where it does not
A VPN can help by keeping administrative interfaces off the public internet and requiring staff to connect through a controlled private tunnel before they reach management pages. That is a sensible exposure-reduction layer for many small organisations.
A VPN is not a patch, not a compromise assessment and not a guarantee that a vulnerable system was never reached. If a SharePoint or management server is affected, apply vendor fixes, remove unnecessary exposure, rotate credentials if compromise is suspected, and review logs.
VPN Rocks view
The consumer lesson is simple: VPNs protect connections, but they do not magically secure the services you connect to. For businesses, the strongest setup is a combination of patched software, limited exposure, MFA, logging and a private-access layer where admin systems do not need to be public.
If a vendor, MSP or internal admin portal asks users to rely only on a VPN while critical patches are missing, push for a real remediation plan. Tunnels reduce attack surface; they do not erase known exploited vulnerabilities.
Sources and further reading
VPN Rocks adds plain-English analysis and practical advice. Source links are included so readers can check the underlying guidance directly.