Digest · Wednesday

Security digest: July 22, 2026

1 editorial brief and 2 known exploited (cisa kev) additions.

All digests · RSS · Markdown

Take stock

Patch this week: Check Point CVE-2026-16232: Exploited Management Auth Bypass. Anyone running an on-premises Check Point Security Management Server or Multi-Domain Server on R82.10, R82, R81.20 or older, above all where the management IP is internet-reachable and Trusted Clients allows Any.
Do you run any of these? Microsoft SharePoint, Check Point SmartConsole. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-07-25.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Patch this week

Jul 22, 2026 · Vulnerability · CVE-2026-16232

Check Point CVE-2026-16232: Exploited Management Auth Bypass

Install the July 2026 Jumbo Hotfix on every Check Point management server this week, and today if the server is reachable from the internet with unrestricted Trusted Clients; that is the setup attackers used to take full admin control.

Must act: Anyone running an on-premises Check Point Security Management Server or Multi-Domain Server on R82.10, R82, R81.20 or older, above all where the management IP is internet-reachable and Trusted Clients allows Any.

Can relax: Smart-1 Cloud customers, whom Check Point says are already protected; teams whose management servers run the fixed Jumbo Hotfix takes; and gateways themselves, which this CVE does not affect.

Check the version and Jumbo Hotfix take on every Security Management and Multi-Domain server (cpinfo -y all).
Install the latest Jumbo Hotfix take for R82.10, R82 or R81.20 through CPUSE, including standby and secondary management servers.
Restrict Trusted Clients to named admin IPs or subnets (Manage & Settings > Permissions & Administrators > Trusted Clients); never use Any.

Read the brief →

Known exploited (CISA KEV) 2

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVE	Product and flaw	CISA due
CVE-2026-50522	Microsoft SharePoint Microsoft SharePoint Deserialization of Untrusted Data Vulnerability	2026-07-25
CVE-2026-16232	Check Point SmartConsole Check Point SmartConsole Improper Authentication Vulnerability	2026-07-25

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.