Check Point published its advisory on July 22 covering multiple vulnerabilities in Security Management, Multi-Domain Management, and firewall products. The most urgent is CVE-2026-16232, an authentication bypass in the SmartConsole login process. The vulnerability allows an unauthenticated remote attacker to obtain an application login token and authenticate to the management server with full administrative privileges, enabling modification of security policies and security configurations. Exploitation requires network access to the Management Server IP address in environments that have not restricted Trusted Clients to a specific list of approved IP addresses or subnets. Check Point confirmed active exploitation affecting what the company describes as a handful of customers with management environments directly exposed to the internet. Targeted customers have been privately notified. Check Point released Jumbo Hotfixes for supported versions R81.20, R82, and R82.10 on July 22. The same advisory covers CVE-2026-62144, a second critical authentication bypass in Gateway management that exploits the same configuration precondition. CISA added CVE-2026-16232 to its KEV catalog on July 22 with a federal remediation deadline of July 25, the shortest timeline between KEV addition and deadline this brief has seen in 2026. Check Point has also published indicators of compromise for the attacks.

Guardio Labs disclosed CVE-2026-48294 yesterday, a vulnerability it named HermeticReader affecting version 26.5.2 of the Adobe Acrobat Chrome extension installed in approximately 329 million browsers. The flaw is a universal cross-site scripting class issue rooted in weak trust boundaries between the extension and web pages it interacts with. Adobe's extension exposed web-accessible pages that accepted JSON data through URL parameters, which Guardio researchers used to inject content into the extension's context. From there, despite WhatsApp Web's Content Security Policy blocking straightforward script injection, they found a more subtle path: the exploit injected an attacker-controlled HTML form into the WhatsApp Web page, moved the live WhatsApp page body into a form option element, and submitted the form to an attacker-controlled server. Because an HTML option element without a value attribute submits its text content, the resulting POST request carried the rendered WhatsApp Web page contents: chat lists, contact names, message previews, profile details, and visible conversation text. The attack required no malware, no phishing for credentials, no WhatsApp vulnerability, no session cookie theft, and no interaction beyond the target visiting a webpage. Guardio disclosed the finding to Adobe, which developed a fix and pushed it through the extension's automatic update mechanism in June, shortly after receiving the report. Adobe assigned CVE-2026-48294 and described it as a UXSS-class cross-origin data disclosure vulnerability. No exploitation in the wild has been confirmed.

CISA added CVE-2026-50522 to its Known Exploited Vulnerabilities catalog on July 22, confirming active exploitation of a CVSS 9.8 deserialization of untrusted data vulnerability in Microsoft SharePoint Server. CVE-2026-50522 was patched in Microsoft's July 15 Patch Tuesday release. The confirmed exploitation pattern documented by threat intelligence analysts is machine key theft: attackers exploit the remote code execution capability to read the IIS machineKey values from the Web.config file on the compromised SharePoint server. IIS machine keys are used by ASP.NET to encrypt, decrypt, and validate authentication tokens, view state, and session cookies across all applications running on that IIS instance. An attacker who possesses the machine key can forge ViewState or Forms Authentication tokens that IIS will treat as fully valid, allowing the attacker to authenticate as any user, including administrators, without knowledge of their credentials. Crucially, machine keys persist across patch cycles. Patching CVE-2026-50522 closes the remote code execution path, but any machine key already stolen before patching remains valid and usable until it is explicitly rotated. This exploitation pattern places it in the same category as the IIS machine key attacks documented in connection with CVE-2025-50982 earlier this year, where stolen keys were used months after the initial breach to maintain persistent access to patched systems.