7JUN

SharePoint stays under active KEV fire

1 min read

10:08UTC

CISA added two Microsoft SharePoint deserialization flaws to its exploited-vulnerabilities catalogue on 16 and 22 July, days after a 14 July hardening advisory.

← Back to The 2024 patch that is breaking now Jump to analysis ↓

TechnologyAssessed

Key takeaway

Two more SharePoint deserialization flaws reached KEV in a week, keeping the platform under active attack.

CISA listed two Microsoft SharePoint deserialization flaws, CVE-2026-58644 and CVE-2026-50522, to the Known Exploited Vulnerabilities (KEV) list on 16 and 22 July. Both landed within a week of the agency's 14 July SharePoint hardening advisory.

Deserialization flaws let an attacker turn data the server unpacks into code it runs, a route that hands remote control of a collaboration platform many organisations expose to the internet. SharePoint has stayed on the active-exploitation list since the three-day patch deadline CISA set on 1 July, and two more entries in one week show the surface has not cooled.

Check Point's SmartConsole authentication flaw, CVE-2026-16232, joined the same 22 July batch. The week's additions widened the exposure across the collaboration and security-management tools that sit at the centre of enterprise networks, not Microsoft's platform alone.

Deep Analysis

In plain English

Microsoft SharePoint is software many organisations use to store and share documents and manage internal workflows. On 16 and 22 July, CISA added two more security flaws in SharePoint, both deserialisation flaws, which let an attacker trick the software into running malicious code by feeding it corrupted data. These are on top of an earlier SharePoint flaw CISA had already listed on 1 July, meaning organisations running their own SharePoint servers have now had three separate urgent patches to apply in about three weeks.

Deep Analysis

Root Causes

SharePoint's deserialisation flaws recur because the platform accepts complex serialised object data across many integration points, including workflows, web parts and API endpoints, and each new feature surface can reopen a deserialisation path even after a prior flaw in the same vulnerability class is patched.

With two more deserialisation CVEs landing five days apart on 16 and 22 July, following the CVE-2026-45659 entry CISA had already catalogued on 1 July, the pattern points to insufficient input-validation coverage across SharePoint's serialisation boundaries generally, well beyond any single fixed function.

Escalation

Three SharePoint deserialisation entries in three weeks indicates sustained rather than one-off attacker interest, though CISA has not attributed the exploitation to a specific named threat actor.

What could happen next?

Consequence
Organisations running on-premises SharePoint face a third urgent patch cycle within three weeks, following the CVE-2026-45659 deadline CISA set on 1 July.
Risk
Repeated deserialisation flaws across separate SharePoint features suggest the underlying input-validation gap has not been fixed platform-wide, raising the chance of a fourth entry.

Sources:CISA

Mentions:CISA →Check Point →Known Exploited Vulnerabilities →Microsoft →CVE-2026-42897 →Microsoft SharePoint →

First Reported In

Update #11 · Zimbra zero-click, and a 15-nation reply

CISA· 24 Jul 2026

Read original →

Causes and effects

Caused by

SharePoint patch clock runs out today

CISA's three-day SharePoint deserialisation KEV deadline set on 1 July is escalated by two further SharePoint deserialisation CVEs landing on 16 and 22 July.

Occurred 1 Jul 2026

Read story →

This Event

SharePoint stays under active KEV fire

Two fresh SharePoint deserialization entries in one week show the platform holding as an active-exploitation battleground rather than a closing surface.

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.