5SEP

SharePoint stays under active KEV fire

1 min read

12:09UTC

CISA added two Microsoft SharePoint deserialization flaws to its exploited-vulnerabilities catalogue on 16 and 22 July, days after a 14 July hardening advisory.

← Back to Four privileged platforms under live attack Jump to analysis ↓

TechnologyAssessed

Key takeaway

Two more SharePoint deserialization flaws reached KEV in a week, keeping the platform under active attack.

CISA listed two Microsoft SharePoint deserialization flaws, CVE-2026-58644 and CVE-2026-50522, to the Known Exploited Vulnerabilities (KEV) list on 16 and 22 July. Both landed within a week of the agency's 14 July SharePoint hardening advisory.

Deserialization flaws let an attacker turn data the server unpacks into code it runs, a route that hands remote control of a collaboration platform many organisations expose to the internet. SharePoint has stayed on the active-exploitation list since the three-day patch deadline CISA set on 1 July , and two more entries in one week show the surface has not cooled.

Check Point's SmartConsole authentication flaw, CVE-2026-16232, joined the same 22 July batch. The week's additions widened the exposure across the collaboration and security-management tools that sit at the centre of enterprise networks, not Microsoft's platform alone.

Deep Analysis

In plain English

Microsoft SharePoint is software many organisations use to store and share documents and manage internal workflows. On 16 and 22 July, CISA added two more security flaws in SharePoint, both deserialisation flaws, which let an attacker trick the software into running malicious code by feeding it corrupted data. These are on top of an earlier SharePoint flaw CISA had already listed on 1 July, meaning organisations running their own SharePoint servers have now had three separate urgent patches to apply in about three weeks.

Deep Analysis

Root Causes

SharePoint's deserialisation flaws recur because the platform accepts complex serialised object data across many integration points, including workflows, web parts and API endpoints, and each new feature surface can reopen a deserialisation path even after a prior flaw in the same vulnerability class is patched.

With two more deserialisation CVEs landing five days apart on 16 and 22 July, following the CVE-2026-45659 entry CISA had already catalogued on 1 July, the pattern points to insufficient input-validation coverage across SharePoint's serialisation boundaries generally, well beyond any single fixed function.

Escalation

Three SharePoint deserialisation entries in three weeks indicates sustained rather than one-off attacker interest, though CISA has not attributed the exploitation to a specific named threat actor.

What could happen next?

Consequence
Organisations running on-premises SharePoint face a third urgent patch cycle within three weeks, following the CVE-2026-45659 deadline CISA set on 1 July.
Risk
Repeated deserialisation flaws across separate SharePoint features suggest the underlying input-validation gap has not been fixed platform-wide, raising the chance of a fourth entry.

Sources:CISA

Mentions:CISA →Check Point →Known Exploited Vulnerabilities →Microsoft →CVE-2026-42897 →Microsoft SharePoint →

First Reported In

Update #11 · Zimbra zero-click, and a 15-nation reply

CISA· 24 Jul 2026

Read original →

Causes and effects

Caused by

SharePoint patch clock runs out today

CISA's three-day SharePoint deserialisation KEV deadline set on 1 July is escalated by two further SharePoint deserialisation CVEs landing on 16 and 22 July.

Occurred 1 Jul 2026

Read story →

This Event

SharePoint stays under active KEV fire

Two fresh SharePoint deserialization entries in one week show the platform holding as an active-exploitation battleground rather than a closing surface.

Different Perspectives

ENISA

ENISA published an SME cyber-resilience maturity model on 6 August and updated the Cyber Resilience Act reporting-platform FAQ on 31 August. The agency supplies common implementation tools for smaller operators, but it cannot fine organisations that do not use them.

UAE Cyber Security Council

On 10 August, the UAE Cyber Security Council said national teams contained attacks on aviation, energy and education before objectives were reached. Its second monthly statement, after a 3 July financial-sector disclosure, makes public reporting of stopped attacks part of its operating posture.

South African authorities

INTERPOL said on 25 August that South African authorities made 39 arrests, seized US$2.67 million and blocked 257 accounts during Operation Jackal IV. Their share of the 23-country operation shows the material enforcement burden in a cross-border fraud case.

Europol

On 2 September, Europol announced the sinkholing of Sality after a 31 August operation involving US, Bulgarian, Hungarian and Romanian authorities. Its more than 11 million linked IP addresses measure infrastructure contact, not confirmed victims, and show why technical partners joined the action.

CISA

From 3 August to 2 September, CISA recorded three-day deadlines for 24 of 37 KEV additions, compared with 34 of 39 from 10 June to 29 July. The falling share changes the urgency signal that US federal agencies and private-sector tooling draw from the catalogue.

Beacon

On 3 September, Beacon said its final report found that an intruder likely exported its customer database during roughly one hour and 27 minutes on 27 July. Charities using the CRM now have a named exposure route, a compromised AWS access key in public build artefacts.