CISA KEV Alert: Check Point and SharePoint Flaws (CVE-2026-16232, CVE-2026-50522) — Detection & Patching Guide

---
title: Potential SharePoint Deserialization Exploit CVE-2026-50522
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects potential exploitation of SharePoint deserialization vulnerability via suspicious process spawning by w3wp.exe.
references:
  - https://www.cisa.gov/news-events/alerts/2026/07/22/cisa-adds-two-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/07/23
tags:
  - attack.initial_access
  - attack.t1190
  - cve-2026-50522
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\w3wp.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate administrative SharePoint scripts
level: high
---
title: Check Point SmartConsole Auth Bypass Activity
id: b2c3d4e5-6789-01ab-cdef-2345678901bc
status: experimental
description: Detects inbound connections to Check Point SmartConsole management ports from non-standard sources, indicating potential exploitation of CVE-2026-16232.
references:
  - https://www.cisa.gov/news-events/alerts/2026/07/22/cisa-adds-two-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/07/23
tags:
  - attack.initial_access
  - attack.t1078
  - cve-2026-16232
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 19009 # Default SmartConsole port
      - 18191 # Alternative management port
    Initiated: false
  filter:
    SourceIp|contains:
      - '192.168.'
      - '10.'
      - '172.16.'
  condition: selection and not filter
falsepositives:
  - Legitimate administrator connections from external network ranges
level: medium

// Hunt for SharePoint RCE (CVE-2026-50522)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName == "w3wp.exe"
| where FileName in~ ("powershell.exe", "cmd.exe", "pwsh.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, CommandLine, FileName
| extend ToDo = "Investigate process tree for web shell activity";

// Hunt for External Check Point Management Access (CVE-2026-16232)
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort in (19009, 18191)
| where ActionType == "InboundConnectionAccepted"
| where not(ipv4_is_in_range(RemoteIP, "10.0.0.0/8")) and not(ipv4_is_in_range(RemoteIP, "192.168.0.0/16")) and not(ipv4_is_in_range(RemoteIP, "172.16.0.0/12"))
| project Timestamp, DeviceName, RemoteIP, RemotePort, LocalPort
| extend ToDo = "Verify if this SmartConsole access is authorized"

// Hunt for suspicious child processes of SharePoint IIS worker
SELECT Pid, Ppid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ "w3wp.exe")
  AND Name =~ "(powershell|cmd|pwsh)"

// Hunt for established network connections to Check Point management ports
SELECT Fd, Family, Type, RemoteAddr, RemotePort, State, Pid
FROM netstat()
WHERE RemotePort IN (19009, 18191) AND State =~ "ESTABLISHED"

# SharePoint: Verify if the vulnerable SharePoint version is running (Placeholder for specific KB check)
# WARNING: Consult the official Microsoft Security Advisory for CVE-2026-50522 for the exact KB number.
$SharePointRegPath = "HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions"
if (Test-Path $SharePointRegPath) {
    Write-Host "[+] SharePoint detected. Please verify patch for CVE-2026-50522 is installed."
    Write-Host "    Action: Compare build number with vendor advisory."
}

# Network Hardening: Check for对外开放 (Exposed) Management Ports
Write-Host "[+] Checking for exposed Check Point Management ports (19009, 18191)..."
$Listeners = Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | Where-Object { $_.LocalPort -eq 19009 -or $_.LocalPort -eq 18191 }
if ($Listeners) {
    Write-Host "[!] WARNING: Management ports are listening. Ensure firewall rules restrict access to trusted subnets only." -ForegroundColor Yellow
    $Listeners | Format-Table LocalAddress, LocalPort, OwningProcess
} else {
    Write-Host "[-] Management ports not detected listening on this host."
}

#!/bin/bash

# Verify Check Point SmartConsole Port Access Restrictions
# Default ports: 19009 (cpd), 18191 (cpm)

echo "[+] Verifying firewall policy for SmartConsole access..."

# Check if policy is installed (Check Point specific command)
if command -v fw &> /dev/null; then
    fw stat | head -n 5
    echo "[!] Review your rulebase to ensure access to port 19009/tcp and 18191/tcp is restricted to specific management stations."
else
    echo "[-] Check Point 'fw' command not found. Is this a management server?"
fi

# Check listening processes
echo "[+] Checking listening processes on management ports..."
netstat -tuln | grep -E ':(19009|18191) '