3AUG

SharePoint stays under active KEV fire

1 min read

16:08UTC

CISA added two Microsoft SharePoint deserialization flaws to its exploited-vulnerabilities catalogue on 16 and 22 July, days after a 14 July hardening advisory.

← Back to KEV deadlines fell from 14 days to three Jump to analysis ↓

TechnologyAssessed

Key takeaway

Two more SharePoint deserialization flaws reached KEV in a week, keeping the platform under active attack.

CISA listed two Microsoft SharePoint deserialization flaws, CVE-2026-58644 and CVE-2026-50522, to the Known Exploited Vulnerabilities (KEV) list on 16 and 22 July. Both landed within a week of the agency's 14 July SharePoint hardening advisory.

Deserialization flaws let an attacker turn data the server unpacks into code it runs, a route that hands remote control of a collaboration platform many organisations expose to the internet. SharePoint has stayed on the active-exploitation list since the three-day patch deadline CISA set on 1 July , and two more entries in one week show the surface has not cooled.

Check Point's SmartConsole authentication flaw, CVE-2026-16232, joined the same 22 July batch. The week's additions widened the exposure across the collaboration and security-management tools that sit at the centre of enterprise networks, not Microsoft's platform alone.

Deep Analysis

In plain English

Microsoft SharePoint is software many organisations use to store and share documents and manage internal workflows. On 16 and 22 July, CISA added two more security flaws in SharePoint, both deserialisation flaws, which let an attacker trick the software into running malicious code by feeding it corrupted data. These are on top of an earlier SharePoint flaw CISA had already listed on 1 July, meaning organisations running their own SharePoint servers have now had three separate urgent patches to apply in about three weeks.

Deep Analysis

Root Causes

SharePoint's deserialisation flaws recur because the platform accepts complex serialised object data across many integration points, including workflows, web parts and API endpoints, and each new feature surface can reopen a deserialisation path even after a prior flaw in the same vulnerability class is patched.

With two more deserialisation CVEs landing five days apart on 16 and 22 July, following the CVE-2026-45659 entry CISA had already catalogued on 1 July, the pattern points to insufficient input-validation coverage across SharePoint's serialisation boundaries generally, well beyond any single fixed function.

Escalation

Three SharePoint deserialisation entries in three weeks indicates sustained rather than one-off attacker interest, though CISA has not attributed the exploitation to a specific named threat actor.

What could happen next?

Consequence
Organisations running on-premises SharePoint face a third urgent patch cycle within three weeks, following the CVE-2026-45659 deadline CISA set on 1 July.
Risk
Repeated deserialisation flaws across separate SharePoint features suggest the underlying input-validation gap has not been fixed platform-wide, raising the chance of a fourth entry.

Sources:CISA

Mentions:CISA →Check Point →Known Exploited Vulnerabilities →Microsoft →CVE-2026-42897 →Microsoft SharePoint →

First Reported In

Update #11 · Zimbra zero-click, and a 15-nation reply

CISA· 24 Jul 2026

Read original →

Causes and effects

Caused by

SharePoint patch clock runs out today

CISA's three-day SharePoint deserialisation KEV deadline set on 1 July is escalated by two further SharePoint deserialisation CVEs landing on 16 and 22 July.

Occurred 1 Jul 2026

Read story →

This Event

SharePoint stays under active KEV fire

Two fresh SharePoint deserialization entries in one week show the platform holding as an active-exploitation battleground rather than a closing surface.

Different Perspectives

Group-IB

Group-IB, headquartered in Singapore, documented on 19 March that The Gentlemen began inside Qilin's own affiliate programme and split from it over a payment dispute. Its analysis makes this window's leak-site tally readable as a fracture inside one ransomware operation rather than the arrival of an unknown crew.

ENISA

ENISA placed EU drinking water and wastewater in its cyber risk zone for the first time on 28 May, finding one in three water entities had never run a risk assessment. CISA's 30 July advisory to American operators reads as the operational sequel to a gap European regulators had already documented two months earlier.

House of Lords and NCSC

The Cyber Security and Resilience Bill sits at House of Lords committee stage, its amendment paper running to 23 July. Separately, the NCSC guidance CISA cited when directing water operators to disconnect controllers is version 1.0 from March 2024, a two-year-old British document doing operational work in an American alert published last week.

heise online

heise online reported on 27 July that Russian state attackers, named as APT28, ran the hotel WiFi credential-harvesting campaign. Its attribution is firmer than ReliaQuest's own hedged low-to-medium confidence assessment of the same intrusion, a difference in national reporting posture rather than a settled dispute over who is responsible.

CISA and ReliaQuest

CISA compressed remediation deadlines under BOD 26-04 while, in the same window, telling water and wastewater operators to disconnect internet-exposed controllers rather than patch them. ReliaQuest, investigating the hotel WiFi campaign, held its assessment of the intrusion route at low-to-medium confidence and declined to name a state sponsor.

AIVD

AIVD co-signed AA26-204A alongside CISA, the NSA and the FBI, adding its signature to the fifteen-agency coalition naming LAUNDRY BEAR. Dutch involvement continues a pattern of joint Five Eyes-adjacent advisories the agency has co-issued with CISA and NCSC through 2026.