The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities affecting Microsoft SharePoint and Check Point SmartConsole to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation and signaling an urgent need for remediation across all organizations.
The update, reported by Security Affairs, places two foundational enterprise platforms firmly in the crosshairs of malicious actors. While the KEV catalog designation legally binds U.S. federal civilian agencies to remediate within a defined timeframe, the advisory carries significant weight as a strong recommendation for the global IT community.
Strategic Target, Acute Risk
The risks are heightened by both the confirmed active exploitation and the strategic value of the targets. SharePoint is a ubiquitous collaboration platform, and its compromise could expose sensitive corporate data and network credentials.
However, the threat from the Check Point SmartConsole flaw is considered particularly severe. As the centralized management hub for security gateways and firewalls, its exploitation could allow an attacker to systematically dismantle an organization's entire defensive perimeter. This represents a potential compromise of the very tools meant to provide security.
The KEV catalog designation fundamentally changes the risk profile, shifting the threat from theoretical to confirmed and ongoing. This is not a standard patch cycle item—it is a live security crisis demanding immediate attention.
Coordinated Response Required
While legally mandated for federal agencies, the advisory strongly recommends that all global public and private sector entities adopt the same urgent response. Security teams should execute a coordinated response within the next 24-48 hours:
- Immediate Discovery: Conduct an emergency audit to locate all instances of Microsoft SharePoint servers and Check Point SmartConsole consoles across the environment.
- Expedited Remediation: Apply official vendor patches or CISA-recommended mitigations without delay, prioritizing internet-facing systems and those managing critical network segments.
- Elevated Priority: Formally designate this effort as the top priority within vulnerability management programs, overriding standard patch cycles until complete.
The CISA action underscores a continuing trend in the threat landscape: attackers are systematically targeting foundational enterprise platforms—collaboration tools and security management interfaces—because compromising them yields disproportionate access and control. Timely patch management for these core systems is now an essential component of cyber defense.
Organizations that delay patching leave themselves exposed to confirmed, active threats that could lead to severe data breaches or total network compromise. The message is unequivocal: the time for assessment is over, and the time for action is now.
美國網絡安全和基礎設施安全局（CISA）已將兩個影響 Microsoft SharePoint 及 Check Point SmartConsole 的嚴重漏洞，加入其「遭積極利用漏洞」（KEV）目錄，確認這些漏洞正遭積極利用，並向所有組織發出需要緊急補救的信號。
據 Security Affairs 報導，此次更新將兩個基礎企業平台明確置於惡意行為者的攻擊目標之中。雖然列入 KEV 目錄的指定在法律上要求美國聯邦民事機構必須在指定期限內進行補救，但此公告作為對全球 IT 界的強烈建議，同樣具有重要影響力。
戰略目標，高風險
由於漏洞已獲證實正遭積極利用以及目標本身具有戰略價值，風險因此被進一步放大。SharePoint 是一個無處不在的協作平台，其若被入侵，可能洩露敏感的企業數據和網絡憑證。
然而，Check Point SmartConsole 漏洞帶來的威脅被視為尤其嚴重。作為安全閘道及防火牆的集中管理樞紐，一旦遭攻擊者利用，可能使其系統性地瓦解一個組織的整個防禦邊界。這代表用於提供安全的工具本身可能已被入侵。
列入 KEV 目錄從根本上改變了風險狀況，將威脅從理論層面轉變為已確認且持續發生的事件。這不是一個標準的補丁週期項目——這是一宗需要立即關注的活躍安全危機。
需協調應對
儘管該建議對聯邦機構具有法律約束力，但它強烈建議全球所有公共和私營實體採取同樣緊急的應對措施。安全團隊應在未來 24-48 小時內進行協調應對：
- 即時排查： 進行緊急審計，在整個環境中找出所有 Microsoft SharePoint 伺服器及 Check Point SmartConsole 控制台的實例。
- 加速補救： 毫不拖延地套用官方供應商補丁或 CISA 建議的緩解措施，優先處理面向互聯網的系統以及管理關鍵網絡分段的系統。
- 提升優先級： 正式將此項工作指定為漏洞管理計劃中的最高優先事項，凌駕於標準的補丁週期之上，直至完成補救。
CISA 的行動凸顯了威脅形勢中的一個持續趨勢：攻擊者正系統性地攻擊基礎企業平台——即協作工具和安全管理界面——因為入侵這些平台能帶來不成比例的訪問權限和控制力。及時為這些核心系統進行補丁管理，現已成為網絡防禦的必要組成部分。
延遲補丁修補的組織，將使自己暴露在已證實的、活躍的威脅之下，可能導致嚴重的數據洩露或整個網絡被入侵。訊息已明確無誤：評估時間已過，行動刻不容緩。