As reported by SecurityAffairs, CISA has expanded its Known Exploited Vulnerabilities (KEV) catalog to include newly confirmed actively exploited flaws affecting Microsoft SharePoint and Check Point SmartConsole. For Shield53, the KEV catalog addition is never a bureaucratic footnote — it is threat intelligence in its most actionable form, representing confirmed adversarial activity against real-world targets.

Security Impact: As reported by SecurityAffairs, CISA has expanded its Known Exploited Vulnerabilities (KEV) catalog to include newly confirmed actively exploited flaws affecting Microsoft SharePoint and Check Point SmartConsole.

Vulnerability Breakdown

CVE-2025-24996 — Microsoft SharePoint
Vulnerability Breakdown
Vendor: Microsoft
Affected Products: Microsoft SharePoint Server (multiple versions)
Severity: High
Type: Remote Code Execution / Privilege Escalation
Patch Available: Yes — addressed in Microsoft's Patch Tuesday cycle
Active Exploitation: Confirmed by CISA
CVE-2025-23009 — Check Point SmartConsole
  • Vendor: Check Point Software Technologies
  • Affected Products: Check Point SmartConsole (network security management platform)
  • Severity: High
  • Type: Local privilege escalation / arbitrary file read
  • Patch Available: Yes — Check Point has issued remediation guidance
  • Active Exploitation: Confirmed by CISA

Why This Matters Beyond the Headlines

SharePoint has long been a crown jewel target for attackers — it sits at the intersection of document collaboration, identity integration, and internal data repositories. When threat actors gain a foothold in SharePoint, they are rarely after the platform itself; they are after the sensitive documents, credential material, and lateral movement opportunities it enables. Organizations running SharePoint on-premises in hybrid environments face compounded risk, as patching cadences are slower and attack surfaces are broader than cloud-native deployments.

The Check Point SmartConsole vulnerability is arguably more alarming from a strategic perspective. SmartConsole is the administrative interface for Check Point's security management — firewalls, VPNs, and policy infrastructure. A compromised SmartConsole session doesn't just expose one system; it hands an adversary the keys to an organization's entire perimeter defense architecture. Attackers who can manipulate firewall policy or exfiltrate VPN configurations can silently create persistence that survives even aggressive incident response efforts.

Shield53 Perspective: Security management planes — the systems used to control security tools — are high-value targets that are systematically under-patched compared to the endpoints and servers they protect. This is a critical blind spot in many enterprise security programs.

Who Is Most at Risk

  • Government and Defense contractors running on-premises SharePoint environments with slow patch cycles
  • Enterprises with hybrid SharePoint deployments (on-prem + SharePoint Online) where patching coordination creates gaps
  • Organizations using Check Point as their primary perimeter security stack, particularly those with distributed SmartConsole access across multiple administrators
  • Managed Security Service Providers (MSSPs) using Check Point to manage multiple client environments — a single compromised SmartConsole instance could cascade across customer tenants

The Broader KEV Implication

CISA's KEV catalog additions carry a binding operational directive (BOD 22-01) requirement for federal civilian agencies: remediate within defined deadlines (typically 14–21 days for high-severity entries). But the private sector should internalize the same urgency. The KEV catalog is curated from confirmed threat intelligence, not theoretical research — every entry represents a vulnerability that has been weaponized against real targets.

The simultaneous addition of SharePoint and a security management platform is notable. This pattern — targeting collaboration infrastructure alongside security tooling — is consistent with sophisticated threat actor playbooks seeking both data access and the ability to suppress or manipulate defenses post-compromise.

Shield53 Recommendations — Immediate Actions

Microsoft SharePoint

  • Apply all available Microsoft Patch Tuesday updates for SharePoint Server immediately; do not wait for scheduled maintenance windows
  • Audit SharePoint exposure — ensure the management interface and sensitive libraries are not publicly accessible without strong authentication
  • Review SharePoint audit logs for anomalous access patterns, particularly large document exports or access from unusual IP ranges
  • Enforce MFA on all SharePoint-connected accounts, including service accounts where feasible
  • Consider network segmentation to limit SharePoint server access to trusted internal networks only

Check Point SmartConsole

  • Apply Check Point's remediation update immediately — do not defer this patch given the confirmed exploitation status
  • Restrict SmartConsole access to dedicated, hardened administrative workstations via allowlisted IP ranges
  • Enable and review SmartConsole audit logs for unauthorized policy changes, new administrator account creation, or configuration exports
  • Rotate credentials for all Check Point management accounts as a precautionary measure
  • Verify firewall policy integrity — confirm no unauthorized rules or VPN configurations have been added

General

  • Cross-reference your asset inventory against both CVEs using your vulnerability management platform immediately
  • Escalate unpatched instances to CISO-level attention — CISA KEV entries are not routine patch items
  • For MSSPs managing Check Point environments: notify affected clients and prioritize remediation across all managed tenants

The window between KEV catalog addition and widespread opportunistic exploitation is measured in days, not weeks. Treat this as a P1 response event.