THE latest Security Affairs newsletter warns of a surge in new malware variants that are leveraging recently disclosed flaws in widely used enterprise software, with the Qilin ransomware group observed chaining these weaknesses to gain footholds inside victim networks.
Researchers point to CVE-2026-16232, a heap overflow in the DNS-over-QUIC listener of Knot Resolver that allows unauthenticated remote code execution, as one of the flaws being exploited in the wild according to a proof of concept published on GitHub. At the same time, CVE-2026-50522 affects Microsoft SharePoint Server, enabling attackers to run arbitrary code without authentication as noted in the CISA advisory. A third flaw, CVE-2026-63030, carries a CVSS rating of 9.8 and is also listed among the actively exploited vulnerabilities highlighted in the weekly threat intelligence briefing from SecurityOnline.
Exploitation of these flaws has been tied to the Qilin ransomware operation, which uses the authentication bypass in Check Point SmartConsole to obtain administrative tokens and then deploys ransomware payloads across compromised domains as reported by SecurityWeek. The group has been observed chaining the SharePoint vulnerability to move laterally after gaining initial access, allowing it to encrypt files and demand payment. Multiple security vendors have noted a spike in alerts referencing these specific CVEs since early July.
The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-16232 and CVE-2026-50522 to its Known Exploited Vulnerabilities catalog on July 21, obliging federal agencies to apply patches by the July 25 deadline per the CISA announcement. Private sector organisations are urged to follow the same timeline, as the vulnerabilities remain under active attack and have been linked to data theft and encryption incidents. The alert also references related issues CVE-2026-62144 and CVE-2026-62145, which affect the same Check Point products and have been patched in the latest Jumbo hotfix.
Defenders should prioritize upgrading Knot Resolver to version 6.4.1 or later to close the DoQ heap overflow, and apply the July 22 Jumbo hotfix for Check Point SmartConsole to mitigate the authentication bypass per the vendor advisory. For SharePoint environments, administrators must install the latest cumulative update that addresses CVE-2026-50522 and review external access policies to limit exposure of management interfaces. Network monitoring should focus on unusual DNS-over-QUIC traffic and unexpected administrative logins from unknown IP addresses.
Organisations are also advised to hunt for indicators of compromise such as unauthorized login tokens in SmartConsole logs and unexpected SharePoint solution deployments, while ensuring that backup and recovery plans are tested and isolated from the production environment. Staying current with vulnerability feeds and applying patches as soon as they are released remains the most effective defence against the evolving tactics of ransomware groups like Qilin.