Cyber Threat Brief — July 23 2026
⚠️ This report is AI-generated. Always validate findings.
1. Check Point SmartConsole Auth Bypass Zero-Day — CVE-2026-16232
TL;DR: CISA added CVE-2026-16232 to KEV July 22. Unauthenticated attacker obtains a SmartConsole application login token for full admin access to Security Management Server — modify firewall policies, push rulesets, exfiltrate configurations.
What’s New:
- CVSS 9.3 improper authentication (CWE-287) in SmartConsole login process via application token
- Remote exploitation requires internet access to Management Server IP + unrestricted Trusted Clients (GUI clients)
- Check Point confirms exploitation against “a very small number of customers”
- Five attacker IPs identified as IOCs (see table below)
- Jumbo hotfix released July 22; restrict Trusted Clients to known IPs immediately
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| 151.241.99.207 | IPv4 | T1078.004 | SmartConsole Audit Logs | Block at perimeter |
| 151.241.99.233 | IPv4 | T1078.004 | SmartConsole Audit Logs | Block at perimeter |
| 158.62.198.182 | IPv4 | T1078.004 | SmartConsole Audit Logs | Block at perimeter |
| 192.142.10.99 | IPv4 | T1078.004 | SmartConsole Audit Logs | Block at perimeter |
| 139.28.37.250 | IPv4 | T1078.004 | SmartConsole Audit Logs | Block at perimeter |
Authentication method: application token | Audit log query | T1078 | SmartConsole Logs & Events | Hunt — any hit = compromise indicator |
| Trusted Clients = Any | Config check | T1190 | SmartConsole | Restrict to known IPs |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No SmartConsole-specific detection; need custom audit log ingestion + alert on “application token” auth |
| Elastic | None | Same gap — no native Check Point SmartConsole audit integration |
| Sigma | None | No community rule yet |
Sources: BleepingComputer, Check Point sk185169, CISA KEV, Help Net Security
2. SharePoint Pre-Auth Deserialization RCE Under Active Exploitation — CVE-2026-50522
TL;DR: CVE-2026-50522 is now actively exploited after a public PoC dropped July 20. Attackers are stealing IIS machine keys via single requests for persistent access — patch alone is insufficient if keys were exfiltrated.
What’s New:
- CISA KEV addition July 22; previously no ITW exploitation when first covered July 16
- PowerShell PoC (Janggggg/GitHub) delivers BinaryFormatter payload as forged SecurityContextToken cookie to
/_trust/default.aspx - Defused detected exploitation of this deserialization vector as early as July 17
- Attackers pulling machine keys for long-term persistence — keys must be rotated post-patch
- 4th actively exploited SharePoint CVE in the past month (after CVE-2026-32201, CVE-2026-45659, CVE-2026-56164)
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
POST /_trust/default.aspx | URI pattern | T1190 | IIS W3SVC logs | Hunt for unauthenticated POST requests |
| SecurityContextToken cookie with BinaryFormatter payload | HTTP artifact | T1059.001 | WAF / IIS logs | Block serialized .NET payloads in WS-Fed responses |
| Machine key access (machineKey in web.config) | Persistence indicator | T1078.003 | File integrity monitoring | Rotate keys post-patch |
| w3wp.exe → cmd.exe/powershell.exe | Process chain | T1059 | Sysmon / EDR | Alert on shell spawn from IIS worker |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | W3WP Spawning Shell (generic) | No SharePoint-specific deserialization detection; need /_trust/default.aspx POST monitoring |
| Elastic | Webshell Detection: Script Process Child of Common Web Processes (generic) | No SecurityContextToken-specific rule |
| Sigma | webshell_detection_file_creation.yml (generic) | No BinaryFormatter payload detection |
Sources: The Hacker News, BleepingComputer, SOCRadar, SecurityWeek, CISA KEV
Status Updates
- CVE-2026-63030/CVE-2026-60137 (WordPress wp2shell): CISA KEV July 21. Mass scanning ongoing with wp2shell/rezwp2shell tool signatures. 35 exploitation attempts across 13 IPs from 7 countries per KEVIntel. Webshells in
/wp-content/cache/. WP-SHELLSTORM crew attributed. Original brief. - CVE-2026-6875 (ServiceNow): Second sandbox-escape gadget chain confirmed by Defused. Fortune 500 and critical infrastructure victims. Self-hosted patches available. Original brief.
- CVE-2026-15409/CVE-2026-15410 (SonicWall SMA1000): Volexity attributes pre-disclosure exploitation to UTA0533 since June 22 — 3 weeks before public disclosure. Federal deadline passed July 17. Original brief.