Date: Thursday, July 23, 2026
Audience: Server admins, MSPs, infra leads, SOC/IR teams
Estimated reading time: 17 minutes

Executive Admin Summary

Today’s highest-consequence development is not a conventional server vulnerability. A multi-agency U.S. advisory now confirms ongoing Iranian-affiliated attacks against internet-accessible programmable logic controllers across government, water, wastewater, and energy environments. The July 22 update expands observed targeting from Rockwell Automation devices to Schneider Electric and Siemens PLCs. Investigators found attackers extracting and modifying controller project files, altering HMI and SCADA displays, and disabling shutdown and alarm logic intended to prevent unsafe operation.

The enterprise control plane is also under direct pressure. Check Point disclosed an actively exploited SmartConsole authentication bypass that can give an unauthenticated attacker full administrative control of exposed Security Management infrastructure. CISA simultaneously added that vulnerability and a critical SharePoint remote-code-execution flaw to the Known Exploited Vulnerabilities Catalog.

The SharePoint authentication prerequisite is not documented consistently. Microsoft’s CVE metadata and CVSS vector describe a network attack requiring no privileges or user interaction, and researchers observed exploitation traffic carrying no authentication material. However, Microsoft advisory language quoted by multiple security firms says an attacker must be authenticated as at least a Site Owner. Until Microsoft resolves that conflict, defenders should treat internet-accessible vulnerable SharePoint servers as potentially exploitable without authentication.

The correct sequence today is: remove exposed PLCs and security-management interfaces from direct internet reach; preserve evidence and validate controller logic; patch Check Point and SharePoint; investigate exposed systems as potential incidents; then rotate machine keys, credentials, tokens, and other trust material only after malicious persistence has been removed. A patch can close an entry point, but it cannot reverse unsafe PLC logic, unauthorized firewall-policy changes, or theft of SharePoint machine keys.

Iranian-affiliated actors alter PLC safety logic across U.S. critical infrastructure

Priority: Critical

Intelligence Update:

On July 22, the FBI, CISA, NSA, EPA, Department of Energy, U.S. Cyber Command’s Cyber National Mission Force, and Department of the Treasury substantially updated joint advisory AA26-097A. The agencies now confirm targeting of Rockwell Automation/Allen-Bradley, Schneider Electric, and Siemens programmable logic controllers, with other manufacturers potentially exposed through the same pattern of unsafe internet connectivity.

Victims span government services and facilities, including municipalities, water and wastewater systems, and the energy sector. The agencies assess that Iranian-affiliated advanced persistent threat actors are conducting the activity to create disruptive effects in the United States.

Assessment:

The attacks rely heavily on exposed or misconfigured operational technology rather than a single new vulnerability. Actors used foreign-hosted infrastructure and legitimate manufacturer configuration software to connect to PLCs, extract project files, modify or delete control logic, and manipulate information shown to operators.

At one victim, attackers retained the PLC’s downstream function while adding logic that overrode instructions responsible for maintaining safe operating parameters. The agencies also found changes that disabled critical shutdown and alarm logic, allowing systems to enter unsafe conditions without notifying operators. This is a direct operational and safety risk, not merely data theft or financially motivated disruption.

Operational Impact:

Immediately remove PLCs, engineering interfaces, and attached cellular modems from direct internet exposure. Do not assume that restoring communications or changing a password returns a controller to a safe state. Validate the running controller program against a known-good, independently verified engineering baseline before returning affected processes to normal operation.

Organizations discovering an exposed or suspicious device should activate their IT/OT incident-response process and coordinate with the manufacturer and relevant government agencies. Safety, process-engineering, and operations personnel must participate in recovery decisions.

Operational Notes:
• Confirmed targeted devices: Rockwell Automation CompactLogix and Micro850; Schneider Electric BMX P34/Modicon M340; Siemens S7-1200 series; potentially other internet-accessible PLCs.
• Observed inbound ports: 44818 and 2222 for Rockwell-associated communications; 502 for Modbus; 102 for Siemens S7 communications; port 22 targeting attached modems.
• Observed tooling: Studio 5000 Logix Designer, EcoStruxure Control Expert, and Siemens Totally Integrated Automation Portal used from actor-controlled infrastructure to retrieve project files.
• Confirmed impact: modification or deletion of project logic and Add-On Instructions; HMI/SCADA display manipulation; disabled shutdown and alarm logic; operational disruption at multiple victims.
• Immediate containment: mediate all remote access through a monitored secure gateway or jump host; restrict PLC communications to explicitly authorized engineering and control-system assets.
• Cellular access: inspect modem configurations and logs; secure management access; consider private access point names, isolated cellular architectures, site-to-site virtual private networks, or equivalent controlled connectivity.
• Physical controls: where supported, place controllers in run mode after validating the loaded project. Do not lock a controller into run mode before confirming that the current program is clean.
• Integrity review: compare running logic, reusable modules, Add-On Instructions, function blocks, input/output mappings, alarm logic, and shutdown logic against known-good engineering copies.
• Backup caution: validate controller backups before restoration; a recent backup may already contain malicious logic.
• Lateral-movement review: examine engineering workstations, HMIs, SCADA servers, historians, modems, jump hosts, and connected administration systems. Reimage systems where unauthorized tools or untrusted access cannot be confidently excluded.
• Newly published actor infrastructure includes 141.11.164[.]153, 185.225.17[.]225, 79.133.46[.]209, 88.80.150[.]199, 88.80.150[.]200, and 88.80.150[.]202. Treat these as investigative pivots, not automatic proof of compromise, and validate association dates before blocking or escalating.

Assessment Confidence: High — the assessment is based on a coordinated federal advisory containing victim-derived findings, observed tooling, affected controller families, network indicators, and documented changes to operational logic.

Sources:
FBI, CISA, NSA, EPA, DOE, CNMF, and Treasury — AA26-097A, Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure, updated July 22, 2026
CISA — CISA, FBI, EPA and U.S. Government Partners Update Warning on Iran-Affiliated Threat Actors Targeting Critical Infrastructure
Rockwell Automation — Security Advisory SD1771
Schneider Electric — Cybersecurity User Guide for Modicon Controller Platform
Siemens — Security Bulletin 104599 and Cybersecurity for Industry Operational Guidelines

Exploited Check Point SmartConsole bypass grants full management authority

Priority: Critical

Intelligence Update:

Check Point disclosed CVE-2026-16232 on July 22 and confirmed exploitation against a handful of customers. CISA added it to the Known Exploited Vulnerabilities Catalog the same day, with a federal remediation deadline of July 25.

The vulnerability affects Check Point Security Management and Multi-Domain Management. It permits an unauthenticated remote attacker to obtain an application login token and authenticate through SmartConsole with full administrative privileges.

Assessment:

Exposure requires a dangerous but clearly defined configuration: the management environment must be directly reachable from the internet without effective Internet Protocol address restrictions. Check Point says Smart-1 Cloud customers are already protected and that the known targeted customers were notified.

This is a Tier 0-adjacent compromise path. An attacker with full SmartConsole administration can alter firewall policy, manipulate objects and trust relationships, modify gateway configuration, weaken logging, or create durable paths into protected networks. The limited observed victim count does not reduce the consequence for any exposed installation.

Public severity scores vary by scoring organization, and an NVD assessment was not finalized at the time of publication. The feed therefore does not present a single CVSS figure as authoritative. Confirmed exploitation and the administrative authority obtained are sufficient to justify critical priority.

Operational Impact:

Immediately identify every Security Management and Multi-Domain Management server, determine whether its management interfaces were reachable from untrusted networks, and restrict access to trusted administrative addresses. Install the July 22 Jumbo Hotfix specified in Check Point SecureKnowledge article sk185169.

Treat an exposed vulnerable management server as requiring compromise assessment, not merely patch deployment. Preserve management, audit, authentication, API, policy-installation, and operating-system evidence before making extensive changes.

Operational Notes:
• Affected product families: Security Management and Multi-Domain Management.
• Vendor-listed affected releases: R81.10, R81.20, R82, and R82.10, with older versions also affected.
• Exploit prerequisite: direct internet exposure of management without effective IP restrictions.
• Result: application login-token acquisition followed by SmartConsole access with full administrative privileges.
• Required mitigation: limit Trusted Clients, including GUI clients, to trusted IP addresses or subnets; place management access behind firewall enforcement; verify implied rules for control connections.
• Required fix: install the latest applicable Jumbo Hotfix released July 22 and verify successful deployment on every management node.
• Hunt for unauthorized administrator sessions, application tokens, API operations, policy changes, newly created or modified objects, altered Trusted Client settings, gateway command execution, log-policy changes, and unexpected policy installations.
• Vendor-published indicators: 151.241.99[.]207, 151.241.99[.]233, 158.62.198[.]182, 192.142.10[.]99, 139.28.37[.]250, and 194.213.18[.]137.
• Do not use absence of the published IP addresses as proof of safety. Review the full exposure window and administrator behavior because attacker infrastructure can change.
• If compromise is established, rebuild management trust deliberately: remove unauthorized configuration, validate policy against an approved baseline, review gateway state, revoke suspect tokens and accounts, rotate affected secrets, and reinstall known-good policy.

Assessment Confidence: High — Check Point confirmed exploitation, defined the exposure condition, published indicators and mitigation guidance, and released a hotfix; CISA independently placed the flaw in KEV. Variations in third-party CVSS scoring do not affect the operational assessment.

Sources:
Check Point — Security Advisory: Action Required, July 2026 Security Update
Check Point SecureKnowledge — sk185169, CVE-2026-16232 Authentication Bypass with SmartConsole Login Using an Application Token
CISA — July 22, 2026, Adds Two Known Exploited Vulnerabilities to Catalog
CVE Program — CVE-2026-16232 record

SharePoint RCE enters KEV amid conflicting authentication guidance

Priority: Critical

Intelligence Update:

CISA added CVE-2026-50522 to KEV on July 22 after watchTowr and other researchers observed exploitation against on-premises SharePoint. Microsoft released security updates on July 14. Public exploit code appeared on July 20, followed within hours by successful exploitation attempts against research sensors.

CVE-2026-50522 is a deserialization vulnerability affecting supported on-premises SharePoint Server editions. Microsoft’s CNA metadata assigns a CVSS 3.1 score of 9.8 with an AV:N/AC:L/PR:N/UI:N vector and describes an unauthorized network attacker executing code without user interaction. SharePoint Online is not affected.

The public documentation is nevertheless inconsistent. Microsoft advisory language quoted by CrowdStrike, SecurityWeek, The Hacker News, and other sources says an attacker must be authenticated as at least a Site Owner. In contrast, Defused reported that captured requests carried no authentication material, while watchTowr observed rapid exploitation following publication of proof-of-concept code. Those field observations and the PR:N vector support a pre-authentication interpretation, but they do not eliminate the contradiction in Microsoft’s published or attributed guidance.

Assessment:

CVE-2026-50522 should be treated as potentially exploitable without authentication until Microsoft clarifies the prerequisite. Defenders should not use authentication controls, the absence of suspicious Site Owner accounts, or the lack of successful interactive logins as reasons to defer patching or compromise assessment.

The distinction from CVE-2026-58644 is also less clean than previously stated. Microsoft’s detailed exploitation language for CVE-2026-58644 requires an authenticated attacker with at least Site Owner permissions, but both CVEs carry metadata that has been interpreted as indicating no required privileges. The safest defensible conclusion is that the current advisory record contains an unresolved prerequisite conflict.

Observed activity attributed to CVE-2026-50522 includes extraction of Internet Information Services machine keys. Stolen machine keys can support forged authentication or malicious deserialization after the original vulnerability has been patched. Consequently, patch status alone cannot establish that an exposed server is trustworthy.

Operational Impact:

Remove unpatched on-premises SharePoint servers from internet reach, preserve evidence, install the July 14 security update, and perform a compromise hunt. Apply these actions regardless of whether the deployment ordinarily requires authentication at the exposed endpoint.

Rotate IIS and ASP.NET machine keys only after intrusion artifacts and persistence have been removed; otherwise, an active attacker may simply steal the replacements. Review connected identity, service-account, database, file-share, and administrative relationships. An on-premises SharePoint compromise can become an internal trust compromise rather than remaining a web-server incident.

Operational Notes:
• Affected products: SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.
• Fixed packages: SharePoint 2016 KB5002891, build 16.0.5561.1001; SharePoint 2019 KB5002883, build 16.0.10417.20175; Subscription Edition KB5002882, build 16.0.19725.20434.
• Authentication prerequisite: unresolved. Microsoft’s CNA metadata and CVSS vector indicate no privileges required; Microsoft advisory prose quoted by several security firms says Site Owner authentication is required.
• Field evidence: Defused observed requests without authentication material and assessed them as matching CVE-2026-50522; watchTowr reported successful exploitation after public proof-of-concept release and theft of SharePoint machine keys.
• Defensive assumption: treat an internet-reachable vulnerable server as potentially pre-authentication exploitable. Do not rely on the more restrictive Site Owner interpretation for exposure decisions.
• Exploitation status: public proof of concept; successful exploitation observed by research sensors; CISA KEV addition July 22; federal remediation due July 25.
• Primary persistence concern: theft of IIS or ASP.NET machine keys and subsequent forged or malicious serialized requests.
• Hunt both authenticated and unauthenticated request paths. Review successful and failed sign-ins, Site Owner activity, token use, anonymous requests, and suspicious traffic reaching SharePoint sign-in and processing endpoints.
• Hunt sources: IIS access logs, Windows event logs, SharePoint Unified Logging Service logs, endpoint telemetry, PowerShell logs, file-creation records, web-root changes, service-account activity, database access, and outbound connections from SharePoint hosts.
• Review for unexpected ASPX or other executable web content, newly created scheduled tasks or services, unusual child processes beneath IIS worker processes, suspicious .NET deserialization activity, and anomalous access to configuration files containing cryptographic material.
• Enable and verify Antimalware Scan Interface integration in Full Mode for every SharePoint web application and monitor its detections.
• Recovery sequence: isolate and preserve; identify and remove malicious artifacts; patch all farm nodes; validate farm and database integrity; rotate machine keys and exposed credentials; restart IIS as required; monitor for renewed access.

Assessment Confidence: Moderate — CISA’s KEV listing, Microsoft’s security packages, public exploit availability, independent sensor observations, and reported machine-key theft establish the core risk with high confidence. The precise authentication prerequisite remains unresolved because Microsoft’s CVSS metadata and attributed advisory prose conflict.

Sources:
Microsoft Security Response Center — CVE-2026-50522, Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft Support — KB5002891, KB5002883, and KB5002882
CISA — Known Exploited Vulnerabilities Catalog entry for CVE-2026-50522
CISA — Guidance on Multiple Vulnerabilities Affecting Microsoft SharePoint
watchTowr — Exploitation Alert for CVE-2026-50522
Defused Cyber — Update to July 17 SharePoint Exploitation Report
CrowdStrike — July 2026 Patch Tuesday Analysis

Patch / Upgrade Watch

Check Point companion management and gateway flaws

The July 22 Check Point Jumbo Hotfix also addresses CVE-2026-62144, a critical management authentication-bypass and privilege-escalation vulnerability, and CVE-2026-62145, a Gaia Portal privilege-escalation vulnerability. Check Point has not reported exploitation of either flaw. Apply the consolidated update while remediating CVE-2026-16232 rather than scheduling separate delayed work.

CVE-2026-62144 can permit an unauthenticated attacker to execute administrative commands on a management server and issue run-script or exec-command operations on managed gateways when management access is insufficiently protected. CVE-2026-62145 can allow an authenticated read-only Gaia Portal user to execute commands with root privileges.

Source: Check Point, Security Advisory: Action Required, July 2026 Security Update; SecureKnowledge articles sk185152 and sk185153

Zimbra 10.1.20 closes command injection and collaboration-server trust gaps

Zimbra released version 10.1.20 with a permanent fix for a command-injection vulnerability in its SNMP monitoring component when SNMP notifications are enabled. The release also corrects four Classic Web Client cross-site-scripting conditions, a mail-forwarding restriction bypass, EWS access-control weaknesses, mailbox-delegation authorization problems, and server-side request forgery in the Nextcloud integration.

No active exploitation has been established for the newly corrected issues. Nevertheless, Zimbra is a high-value email and identity-adjacent platform with a history of espionage targeting. Upgrade supported 10.1 installations to 10.1.20 and review whether SNMP notifications, Classic Web Client, Exchange Web Services, delegated mailboxes, or Nextcloud integration expand the relevant attack surface.

Source: Zimbra, Patch Release Update: Zimbra 10.1.20; Zimbra Releases 10.1.20

Oracle July CPU requires inventory-driven prioritization

Oracle’s July Critical Patch Update contains unusually large patch sets across control-plane, communications, middleware, enterprise-application, and utility products. Oracle’s product risk matrices report 168 new security patches for Oracle Communications, including 122 remotely exploitable without authentication; 410 for E-Business Suite, including 45 remotely exploitable without authentication; 355 for Fusion Middleware, including 219 remotely exploitable without authentication; 27 for Enterprise Manager, including 13 remotely exploitable without authentication; and 14 for Utilities Applications, including 10 remotely exploitable without authentication.

These counts do not mean every deployment exposes every flaw, and Oracle has not said the entire set is being exploited. Prioritize internet-reachable Communications and Fusion Middleware components, Enterprise Manager, systems supporting utilities or operational environments, and applications holding privileged integration credentials. Use the product-specific risk matrices rather than treating the CPU as one undifferentiated patch.

Source: Oracle, Critical Patch Update Advisory — July 2026 and associated product risk matrices

Rockwell FactoryTalk identity validation

CISA’s July 21 industrial advisory covers CVE-2026-10714 in FactoryTalk Services Platform 6.60. The weakness involves validation of JSON Web Token signatures and could allow an attacker to impersonate an authorized user on the FactoryTalk Services Platform server. Operators using this release should review Rockwell’s advisory and upgrade guidance within controlled OT change-management procedures.

No public exploitation specifically targeting this vulnerability has been established. Its importance comes from the platform’s authority within industrial environments, not from a confirmed connection to the current Iranian-affiliated campaign.

Source: CISA ICSA-26-202-07, Rockwell Automation FactoryTalk Services Platform

Detection / Monitoring Watch

ServiceNow exploitation report remains contested

Third-party threat-intelligence company Defused Cyber reported traffic matching public proof-of-concept exploitation of CVE-2026-6875 through POST requests to /assessment_thanks.do. The vulnerability is a critical pre-authentication ServiceNow AI Platform sandbox escape capable of remote code execution under specific conditions.

ServiceNow says it has not observed evidence that the reported activity affected instances hosted by ServiceNow. That statement does not disprove scanning or attacks against self-hosted or partner-managed deployments, but it prevents the broader claim that ServiceNow’s hosted fleet is known to be compromised.

Confirm that hosted, self-hosted, and partner-managed instances are on Brazil EA or GA, Australia Patch 2, Zurich Patch 7b or Patch 9, Yokohama Patch 12 Hot Fix 1b or Patch 13, or a later corrected release. Hunt for unusual requests to the documented endpoint, unexpected scripted activity, new integrations or credentials, and suspicious behavior on MID Servers and other connected proxy systems.

Sources:
ServiceNow — KB3137947
Defused Cyber — CVE-2026-6875 exploitation observation
ServiceNow — Statement on reported CVE-2026-6875 activity

WordPress wp2shell moves from patch problem to compromise-assessment problem

CISA added CVE-2026-60137 and CVE-2026-63030 to KEV on July 21. Rapid7’s July 22 update confirms multiple public proof-of-concept implementations and full technical disclosure. When chained, the REST API batch-route confusion bypasses restrictions around the SQL-injection path, permitting an unauthenticated attacker to create an administrator account and upload executable plugin code.

Verify WordPress 6.8.6, 6.9.5, 7.0.2, or a later fixed release as appropriate. Review /wp-json/batch/v1 and equivalent rest_route requests, unfamiliar administrators, plugins, themes, PHP files, scheduled tasks, database exports, outbound connections, and credential-hash access. Automatic updates should be verified rather than assumed.

Sources:
WordPress — WordPress 7.0.2 Security Release
CISA — Known Exploited Vulnerabilities Catalog
Rapid7 — CVE-2026-63030 wp2shell
VulnCheck — WP2Shell Vulnerabilities

Lower-Priority Server-Risk Notes

The ten CISA industrial advisories published July 21 deserve installed-base review, but most do not carry evidence of exploitation and several require local access, authenticated access, or interaction with engineering files. They should not displace the confirmed Iranian PLC campaign or the exploited Check Point and SharePoint vulnerabilities.

Zimbra 10.1.20 is important, particularly for externally reachable sovereign, government, defense, and contractor mail systems, but the current evidence supports expedited patching rather than an assumption of compromise.

The raw Oracle patch totals are operationally significant but are not equivalent to 1,000 independently internet-exploitable server vulnerabilities. Exposure, enabled components, authentication requirements, protocol reachability, and business function must drive prioritization.

Financially motivated activity involving VPNs and edge appliances remains relevant when it reveals unauthorized network access. It was not promoted solely because of ransomware branding; the deciding factors remain exploitability, control-plane access, operational reach, and potential safety consequences.

Admin Action Checklist

  • Remove directly exposed PLCs, programming interfaces, and cellular modems from public internet access.
  • Validate controller project files, reusable modules, alarms, shutdown logic, HMI displays, and SCADA data against independently trusted engineering baselines.
  • Query OT, firewall, modem, and engineering logs for the July 22 AA26-097A indicators and suspicious traffic on ports 44818, 2222, 102, 502, and 22.
  • Restrict Check Point Security Management access to trusted clients and addresses; install the July 22 Jumbo Hotfix.
  • Hunt Check Point management systems for unauthorized tokens, administrator sessions, policy changes, object modifications, gateway commands, and altered logging.
  • Isolate and patch exposed on-premises SharePoint farms with KB5002891, KB5002883, or KB5002882 as appropriate.
  • Assume vulnerable internet-reachable SharePoint may be exploitable without authentication until Microsoft resolves the conflicting prerequisite guidance.
  • Hunt both authenticated and unauthenticated SharePoint request paths before rotating IIS machine keys; remove persistence, then rotate keys, service credentials, and other exposed trust material.
  • Confirm ServiceNow’s corrected family or patch level and examine self-hosted, partner-managed, MID Server, and integration exposure.
  • Verify WordPress fixed versions and perform post-exploitation review for administrator creation, database access, malicious plugins, and PHP web shells.
  • Upgrade Zimbra 10.1 deployments to 10.1.20, prioritizing systems with SNMP notifications or Classic Web Client enabled.
  • Map Oracle’s July CPU to the installed inventory, prioritizing Communications, Fusion Middleware, Enterprise Manager, Utilities, and externally reachable integrations.
  • Review FactoryTalk Services Platform 6.60 exposure and remediate CVE-2026-10714 under OT change control.

BCG Assessment

Today’s highest-risk items share a common structural failure: administrative or operational authority is reachable through interfaces that were never meant to be exposed without strong mediation. Internet-accessible PLCs place physical processes within reach of foreign actors using legitimate engineering software. Internet-accessible Check Point management turns a token flaw into firewall-administrator authority. Internet-accessible SharePoint may turn unsafe deserialization into server execution and theft of durable trust material without requiring a valid account.

Defenders should sequence work according to what the system controls, not simply by CVSS score. First remove external reach to devices capable of changing physical processes or security policy. Then preserve evidence and determine whether trusted state has already been modified. Patch after containment is stable, and rotate trust only after persistence has been removed.

The SharePoint documentation conflict illustrates an additional rule: when vendor prose, CVSS metadata, and observed attack traffic disagree, defenders should not select the interpretation that permits delay. The correct operational assumption is the one that prevents avoidable exposure while the evidence is reconciled.

The broader strategic lesson is that recovery must validate state, not merely software version. A patched PLC can still contain malicious ladder logic. A patched Check Point server can still contain hostile policy. A patched SharePoint server can remain impersonable through stolen machine keys. In high-consequence environments, “updated” and “trusted” are separate findings, and both must be established before normal operations resume.

Jonathan Lockhart is a cybersecurity researcher and investigative journalist at bordercybergroup.com.

If you would like to support our work — useful, well-researched, ad-free cybersecurity intelligence — subscribe, comment, or buy us a coffee! Thanks.