# Threat Intel Brief — July 23, 2026

TL;DR

  • Check Point SmartConsole zero-day (CVE-2026-16232) actively exploited; unauthenticated attackers gain full admin access to security management servers. CISA orders federal agencies to patch by July 25.
  • Microsoft SharePoint Server RCE cluster under active exploitation; five critical vulnerabilities (CVE-2026-50522, CVE-2026-58644, CVE-2026-56164, CVE-2026-45659, CVE-2026-32201) enable unauthenticated remote code execution on internet-exposed instances.
  • Langflow AI framework RCE (CVE-2026-0770) exploited in ransomware campaigns; over 220 attacks targeting AWS credentials and container metadata since June 27.
  • Linux kernel privilege escalation flaws disclosed: RefluXFS (CVE-2026-64600) grants root on default RHEL/Fedora/Amazon Linux; Ubuntu snap-confine (CVE-2026-8933) enables local root on Desktop installations.
  • Kratos phishing-as-a-service infrastructure dismantled by German-US-Indonesian law enforcement; platform enabled 1,800 customers to bypass MFA and steal Microsoft 365 sessions.

---

Critical Threats

Check Point SmartConsole Authentication Bypass (CVE-2026-16232)

What happened:
Check Point disclosed an actively exploited zero-day vulnerability in SmartConsole, the graphical management interface for Security Management Server and Multi-Domain Management products. The authentication bypass flaw (CVSS 9.3) allows unauthenticated remote attackers to obtain administrator login tokens and modify security policies. Check Point confirms a small number of customers have been compromised. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on July 23, with a federal remediation deadline of July 25, 2026.

Impact:
Attackers with network access to exposed management servers can gain full administrative control without credentials, enabling modification of firewall rules, VPN configurations, and security policies. This facilitates lateral movement, policy manipulation to disable protections, and preparation for ransomware or espionage operations. Organizations with internet-exposed Management Server IPs lacking Trusted Client IP restrictions face immediate risk. Check Point has published six attacker IP addresses associated with exploitation activity.

Recommendations:

  • Apply Check Point's July 22 Jumbo hotfix immediately to all Security Management and Multi-Domain Management servers (versions R77.30 through R82.10).
  • Restrict Trusted Clients to specific IP addresses or subnets in SmartConsole configuration; remove internet exposure of Management Server IPs where operationally feasible.
  • Block inbound connections from published IoC IPs: 151.241.99[.]207, 151.241.99[.]233, 158.62.198[.]182, 192.142.10[.]99, 139.28.37[.]250, 194.213.18[.]137.
  • Review SmartConsole authentication logs for unauthorized admin sessions or policy changes since early July 2026; search for "Authentication method: application token" entries.
  • Implement Check Point Hardening Best Practices Guide for Security Management Servers.

---

Microsoft SharePoint Server RCE Vulnerabilities Under Active Exploitation

What happened:
Microsoft patched five critical vulnerabilities in SharePoint Server on July 14, 2026. WatchTowr observed active exploitation of CVE-2026-50522 (CVSS 9.8, deserialization RCE) on July 20, with proof-of-concept code publicly available. CERT-EU issued an urgent advisory recommending immediate patching and credential rotation for all internet-exposed SharePoint instances. The cluster includes CVE-2026-58644 (CVSS 9.8, unauthenticated RCE), CVE-2026-56164 (CVSS 9.8, privilege escalation), CVE-2026-45659 (CVSS 8.8, authenticated RCE), and CVE-2026-32201 (CVSS 6.5, spoofing).

Impact:
Unauthenticated attackers can execute arbitrary code on vulnerable SharePoint Server 2016, 2019, and Subscription Edition instances, leading to full server compromise. Organizations running on-premise SharePoint with internet exposure face critical risk of credential theft, lateral movement, data exfiltration, and ransomware deployment. The rapid weaponization timeline—six days from patch to public exploit—indicates sustained adversary interest in SharePoint infrastructure.

Recommendations:

  • Apply Microsoft security updates from July 14, 2026 (CVE-2026-50522, CVE-2026-56164, CVE-2026-58644) and backfill April-May 2026 patches (CVE-2026-32201, CVE-2026-45659) immediately.
  • Rotate all credentials (service accounts, admin accounts, application passwords) for SharePoint servers exposed to the internet prior to patching.
  • Conduct compromise assessment: review authentication logs, inspect for unexpected user accounts, check scheduled tasks and web shells, analyze outbound network connections for C2 activity.
  • Remove direct internet exposure for SharePoint Server instances; implement reverse proxy with WAF or restrict access via VPN.
  • Prioritize patching for SharePoint Subscription Edition, 2019, and 2016 environments in that order based on exploitation likelihood.

---

Langflow AI Framework RCE Exploited in Ransomware Campaigns

What happened:
CISA issued an emergency directive under BOD 26-04 ordering federal agencies to patch CVE-2026-0770, an actively exploited remote code execution vulnerability in Langflow, a visual framework for building AI agents. The flaw enables unauthenticated attackers to execute arbitrary code as root via the /api/v1/validate/code endpoint. Over 220 exploitation attempts from 64 unique IPs have been observed since June 27, 2026, targeting AWS credentials, environment variables, and container metadata. The JadePuffer ransomware gang has leveraged Langflow vulnerabilities in prior campaigns.

Impact:
Unauthenticated remote code execution with root privileges allows full system compromise, credential theft, cloud environment exposure, and ransomware deployment. Organizations running Langflow face immediate risk of AWS credential exfiltration, container escape, and lateral movement into cloud infrastructure. This is the fourth exploited Langflow vulnerability added to CISA's KEV catalog since May 2025, indicating sustained attacker interest in AI development platforms.

Recommendations:

  • Apply vendor patches for CVE-2026-0770 immediately; federal agencies must complete remediation by July 25, 2026.
  • Review web server and application logs for suspicious POST requests to /api/v1/validate/code endpoint since June 27, 2026.
  • Restrict network access to Langflow validation functionality using firewall rules or application-level controls.
  • Rotate all AWS credentials, API keys, and secrets accessible from Langflow environments where compromise cannot be ruled out.
  • Audit container metadata access and environment variables for unauthorized disclosure; review cloud IAM logs for anomalous activity.

---

Linux Kernel Privilege Escalation: RefluXFS and Ubuntu snap-confine

What happened:
Qualys disclosed two local privilege escalation vulnerabilities affecting major Linux distributions. RefluXFS (CVE-2026-64600) is a nine-year-old flaw in XFS filesystems with reflink enabled, allowing unprivileged users to overwrite root-owned files and gain persistent root access. Default installations of RHEL/CentOS Stream 8/9/10, Fedora Server 31+, and Amazon Linux 2023 are vulnerable. Separately, CVE-2026-8933 in Ubuntu's snap-confine allows local users to escalate to root on default Ubuntu Desktop 24.04, 25.10, and 26.04 installations. Proof-of-concept exploits are publicly available for both vulnerabilities.

Impact:
Attackers with local user access or code execution can escalate to root within seconds. RefluXFS overwrites survive reboot and leave metadata unchanged, enabling persistent compromise without detection. Critical risk for multi-tenant environments, CI/CD pipelines, shared hosting, developer workstations, and any system where untrusted code runs locally. Red Hat issued patches July 14–17, eight days before public disclosure.

Recommendations:

  • RefluXFS: Verify XFS reflink status with xfs_info / | grep reflink=; apply vendor kernel updates immediately (RHEL 8 RHSA-2026:39179/39180, RHEL 10 RHSA-2026:39494, Debian trixie-security kernel 6.12.96-1+). Reboot all patched systems to load the fixed kernel.
  • snap-confine: Apply latest snapd updates on all Ubuntu Desktop 24.04, 25.10, and 26.04 systems; verify installed snapd version after patching.
  • Review /etc/passwd and setuid-root binaries for unexpected modifications on systems exposed before patching; compare checksums against known-good baselines.
  • Prioritize patching for multi-tenant hosts, CI/CD workers, shared development environments, and administrative endpoints.
  • Monitor for anomalous snap-confine process behavior and systemd-udevd execution patterns in endpoint logs.

---

Threat Actor Activity

Everest Ransomware Gang Targets Swiss Rail Manufacturer

Everest, a data exfiltration extortion group active since 2020, demanded $12.3 million from Swiss rail manufacturer Stadler Rail after breaching a third-party data exchange platform shared with a supplier. The gang exfiltrated technical information and threatened to publish stolen data on its dark web leak site. Stadler Rail rejected the ransom demand. Everest has evolved from traditional ransomware (encryption + exfiltration) to pure data theft extortion, and previously functioned as an initial access broker selling network access to other threat actors. The group's infrastructure was defaced in April 2025 but reconstituted on a new domain, demonstrating operational resilience.

Defensive focus: Implement zero-trust architecture for third-party data exchange platforms with strict network segmentation. Deploy data loss prevention (DLP) solutions with egress filtering to detect unauthorized exfiltration of technical documentation. Establish continuous monitoring of supply chain partners' security postures through vendor risk management programs.

---

Chaos Ransomware Gang Deploys msaRAT Backdoor

The Chaos ransomware gang, linked to Iranian state-backed threat actor MuddyWater, is deploying a new Rust-based backdoor called msaRAT that conceals command-and-control traffic by routing it through Chrome or Edge browsers in headless mode. The malware leverages the Chrome DevTools Protocol (CDP) to establish C2 communications via WebRTC channels routed through Twilio TURN servers and Cloudflare Workers endpoints, employing dual-layer encryption (WebRTC DTLS + ChaCha20-Poly1305). Initial access is achieved through phishing, with persistence established via remote management software. The malware executes Windows commands received through the encrypted channel.

Defensive focus: Monitor for Chrome or Edge browser processes launched with debugging flags (--remote-debugging-port, --headless) via Sysmon Event ID 1. Implement network monitoring for unusual WebRTC traffic patterns, particularly connections to Twilio TURN servers lacking standard ICE candidates. Block or restrict access to Cloudflare Workers domains (*.workers.dev) where operationally feasible.

---

Kratos Phishing-as-a-Service Infrastructure Dismantled

German, US, and Indonesian law enforcement dismantled the Kratos phishing-as-a-service platform, one of the world's most widely used criminal phishing kits designed to steal Microsoft 365 sessions and bypass MFA. The platform enabled approximately 1,800 paying customers to conduct adversary-in-the-middle (AiTM) attacks, supporting roughly 15,000 campaigns monthly since late 2024. Indonesian authorities arrested the individual allegedly responsible for developing and operating the kit. The platform operated as a franchise model accessible via cryptocurrency payment and Telegram storefronts, targeting victims across more than 30 countries with concentration in Europe and the United States.

Defensive focus: Revoke active Microsoft 365 sessions for compromised accounts, as password resets alone do not invalidate stolen session cookies. Deploy phishing-resistant authentication methods such as FIDO2/WebAuthn for high-value accounts. Monitor web traffic for Kratos signature: paired assets barr.svg and lg.svg with POST requests to next.php or save.php endpoints.

---

Geopolitical Context

South Korea Diplomatic Academy Breach

South Korea's National Diplomatic Academy suffered a ten-month breach (April 2025–February 2026) of its online education system, resulting in theft of personal information from current and former Ministry of Foreign Affairs employees, including overseas diplomats worldwide. The compromise provided sustained access to personnel data of diplomats serving globally, potentially enabling profiling, social engineering, and targeting of South Korean diplomatic personnel. No attribution has been provided by South Korean authorities. The delayed public disclosure (five months after detection) reflects Seoul's sensitivity regarding diplomatic and security affairs, particularly given South Korea's strategic position amid U.S.-China competition and ongoing tensions with North Korea.

---

CERT-EU Warns of SharePoint Exploitation Campaign

CERT-EU's urgent advisory on Microsoft SharePoint Server vulnerabilities signals direct concern for EU institutions, bodies, and agencies. The recommendation to rotate credentials and conduct compromise assessments implies a non-negligible probability of successful intrusions prior to patching. SharePoint Server remains widely deployed across European public administration, defense contractors, and critical infrastructure operators, particularly in jurisdictions with data residency mandates that favor on-premise deployments. The advisory's call to reconsider internet exposure of SharePoint instances reflects a broader strategic shift toward zero-trust architectures, consistent with the EU's NIS2 Directive implementation timeline.

---

Recommended Actions

Immediate (0–24 hours)

  • Patch Check Point SmartConsole (CVE-2026-16232) and restrict Trusted Client IPs; block published IoC addresses.
  • Patch Microsoft SharePoint Server (CVE-2026-50522, CVE-2026-58644, CVE-2026-56164, CVE-2026-45659, CVE-2026-32201) and rotate credentials for exposed instances.
  • Patch Langflow (CVE-2026-0770) and rotate AWS credentials accessible from Langflow environments.
  • Patch Linux kernel for RefluXFS (CVE-2026-64600) on RHEL/Fedora/Amazon Linux and reboot systems.
  • Patch Ubuntu snapd for snap-confine (CVE-2026-8933) on Desktop 24.04, 25.10, and 26.04.

Within 24–72 hours

  • Conduct compromise assessments on SharePoint, Check Point, and Langflow environments: review authentication logs, inspect for unauthorized accounts, analyze outbound connections.
  • Verify Adobe Acrobat Chrome extension is updated to version 26.5.2.3 or later (CVE-2026-48294).
  • Audit Windmill instances for version 1.603.3 or later (CVE-2026-29059); review logs for path traversal attempts.
  • Revoke active Microsoft 365 sessions for accounts potentially compromised via Kratos phishing campaigns.

This week

  • Remove internet exposure for SharePoint Server and Check Point Management Server instances; implement reverse proxy with WAF or VPN access.
  • Implement zero-trust architecture for third-party data exchange platforms and supplier connections.
  • Deploy phishing-resistant authentication (FIDO2/WebAuthn) for high-value Microsoft 365 accounts.
  • Review XFS filesystem configurations across Linux estate; prioritize patching for multi-tenant and CI/CD environments.
  • Monitor for Chrome/Edge browser processes launched with debugging flags via Sysmon Event ID 1 to detect msaRAT activity.

---

Watch List

  • FortiBleed campaign: Global threat targeting Fortinet infrastructure emerged in June 2026; technical details and CVE assignment pending. Audit Fortinet devices for unauthorized access and apply emergency patches as released.
  • Trojanized NuGet package: "Newtonsoftt.Json.Net" typosquat targets Digitain betting platform; audit .NET projects for dependency and replace with legitimate Newtonsoft.Json.
  • Azure DevOps MCP server flaw: Hidden PR comments can hijack AI review agents; disable auto-approve mode and manually inspect pull request descriptions in raw HTML mode.
  • Upbound Group breach: Threat actors stole data and used it to create $13 million in fraudulent Acima leases, demonstrating real-world financial impact of compromised data.
  • Microsoft Exchange Online issue: Ongoing problem incorrectly quarantining customer mailboxes since July 21; monitor for resolution and review quarantine logs for false positives.

---

Sources

  • BleepingComputer: Check Point SmartConsole zero-day, SharePoint RCE, Langflow exploitation, Kratos takedown, msaRAT backdoor, Ubuntu snap-confine, Adobe Chrome extension, Windmill path traversal, Stadler Rail ransomware, South Korea diplomatic breach, Upbound Group breach, Exchange Online quarantine issue
  • The Hacker News: Check Point SmartConsole, SharePoint RCE, RefluXFS Linux kernel flaw, Kratos phishing kit, Adobe Acrobat extension, Windmill exploitation, Azure DevOps MCP flaw, trojanized NuGet package
  • CERT-EU: Microsoft SharePoint Server critical vulnerability advisory (2026-009)
  • NCSC-FI: FortiBleed campaign (Cyber Weather for June 2026)