24JUL

SharePoint stays under active KEV fire

1 min read

18:20UTC

CISA added two Microsoft SharePoint deserialization flaws to its exploited-vulnerabilities catalogue on 16 and 22 July, days after a 14 July hardening advisory.

← Back to Zimbra zero-click, and a 15-nation reply Jump to analysis ↓

TechnologyAssessed

Key takeaway

Two more SharePoint deserialization flaws reached KEV in a week, keeping the platform under active attack.

CISA listed two Microsoft SharePoint deserialization flaws, CVE-2026-58644 and CVE-2026-50522, to the Known Exploited Vulnerabilities (KEV) list on 16 and 22 July. Both landed within a week of the agency's 14 July SharePoint hardening advisory.

Deserialization flaws let an attacker turn data the server unpacks into code it runs, a route that hands remote control of a collaboration platform many organisations expose to the internet. SharePoint has stayed on the active-exploitation list since the three-day patch deadline CISA set on 1 July , and two more entries in one week show the surface has not cooled.

Check Point's SmartConsole authentication flaw, CVE-2026-16232, joined the same 22 July batch. The week's additions widened the exposure across the collaboration and security-management tools that sit at the centre of enterprise networks, not Microsoft's platform alone.

Deep Analysis

In plain English

Microsoft SharePoint is software many organisations use to store and share documents and manage internal workflows. On 16 and 22 July, CISA added two more security flaws in SharePoint, both deserialisation flaws, which let an attacker trick the software into running malicious code by feeding it corrupted data. These are on top of an earlier SharePoint flaw CISA had already listed on 1 July, meaning organisations running their own SharePoint servers have now had three separate urgent patches to apply in about three weeks.

Deep Analysis

Root Causes

SharePoint's deserialisation flaws recur because the platform accepts complex serialised object data across many integration points, including workflows, web parts and API endpoints, and each new feature surface can reopen a deserialisation path even after a prior flaw in the same vulnerability class is patched.

With two more deserialisation CVEs landing five days apart on 16 and 22 July, following the CVE-2026-45659 entry CISA had already catalogued on 1 July, the pattern points to insufficient input-validation coverage across SharePoint's serialisation boundaries generally, well beyond any single fixed function.

Escalation

Three SharePoint deserialisation entries in three weeks indicates sustained rather than one-off attacker interest, though CISA has not attributed the exploitation to a specific named threat actor.

What could happen next?

Consequence
Organisations running on-premises SharePoint face a third urgent patch cycle within three weeks, following the CVE-2026-45659 deadline CISA set on 1 July.
Risk
Repeated deserialisation flaws across separate SharePoint features suggest the underlying input-validation gap has not been fixed platform-wide, raising the chance of a fourth entry.

Sources:CISA

Mentions:Microsoft SharePoint →CISA →Check Point →Known Exploited Vulnerabilities →Microsoft →CVE-2026-42897 →

First Reported In

Update #11 · Zimbra zero-click, and a 15-nation reply

CISA· 24 Jul 2026

Read original →

Causes and effects

Caused by

SharePoint patch clock runs out today

CISA's three-day SharePoint deserialisation KEV deadline set on 1 July is escalated by two further SharePoint deserialisation CVEs landing on 16 and 22 July.

Occurred 1 Jul 2026

Read story →

This Event

SharePoint stays under active KEV fire

Two fresh SharePoint deserialization entries in one week show the platform holding as an active-exploitation battleground rather than a closing surface.

Different Perspectives

AIVD

AIVD co-signed AA26-204A alongside CISA, the NSA and the FBI, adding its signature to the fifteen-agency coalition naming LAUNDRY BEAR. Dutch involvement continues a pattern of joint Five Eyes-adjacent advisories the agency has co-issued with CISA and NCSC through 2026.

CNCERT

China's national CERT was not party to AA26-204A and has previously argued that Western KEV-based advisories conflate demonstrated exploit capability with confirmed breach impact. It is expected to treat this fortnight's coalition-based Russia attribution as a Five Eyes-led exercise rather than an independently verified finding.

Russia

Moscow has not publicly responded to the AA26-204A attribution naming LAUNDRY BEAR as a Russian state-supported actor behind the Zimbra zero-click chain. Russian officials have consistently denied state involvement in prior Western cyber-attribution advisories, a pattern this fifteen-agency coalition is likely to meet with the same denial.

National Crime Agency

The NCA called the Woolwich Crown Court sentencing of Owen Flowers and Thalha Jubair Britain's largest-ever cybercrime prosecution. It expects continued pressure on Scattered Spider's UK-linked membership, alongside City of London Police's push for statutory Cyber Crime Risk Orders.

CISA

CISA co-led AA26-204A naming LAUNDRY BEAR and added five more flaws to KEV this fortnight, including a three-day Oracle EBS deadline, while absorbing a one-month detection-to-listing gap on FortiSandbox. It expects the risk-tiered BOD 26-04 model to hold even as a proposed $707m FY27 cut threatens the staffing behind it.

UK managed service providers and data centre operators

Newly brought into critical-infrastructure scope by the Cyber Security and Resilience Bill's Lords second reading, facing fines up to £17m or 4% of global turnover and a new near-miss reporting duty they did not previously carry. The sector moves from best-practice guidance to statutory exposure within this Parliamentary session.