CISA adds two exploited vulnerabilities to Known Exploited Vulnerabilities Catalog
CISA said it added two vulnerabilities to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation, and urged organizations to prioritize fixes.
CISA said on July 22 that it added two vulnerabilities to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation.
The catalog is a federal tool for identifying security flaws attackers are already using in the wild. CISA said the additions reinforce the need for risk-based vulnerability management, especially on systems exposed to the public internet.
The two vulnerabilities listed are CVE-2026-16232, which CISA described as a Check Point SmartConsole improper authentication issue, and CVE-2026-50522, which CISA described as a Microsoft SharePoint deserialization of untrusted data issue. CISA said vulnerabilities like these are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
The notice cites Binding Operational Directive 26-04, titled Prioritizing Security Updates Based on Risk. CISA said the directive sets vulnerability management requirements for Federal Civilian Executive Branch agencies and reinforces the importance of the KEV Catalog.
Under the directive, CISA said federal agencies must prioritize rapid remediation of high-risk vulnerabilities listed in the KEV Catalog on publicly exposed assets that could grant total control after exploitation. It said lower-risk vulnerabilities can be deferred. The notice also said the directive sets expectations for when agencies must check whether a system was compromised before a patch was applied.
CISA said the directive applies only to FCEB agencies, but it encouraged all organizations to adopt risk-based vulnerability management and to prioritize remediation of KEV-listed flaws.
The agency said it will continue to add vulnerabilities that meet its criteria. It also said organizations can nominate an exploited vulnerability not already in the catalog through CISA’s KEV Nomination Form, provided the issue has a CVE ID, evidence of exploitation and clear mitigation guidance.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()