Critical SharePoint RCE CVE-2026-50522 Actively Exploited After PoC Drop
Microsoft has confirmed that a third SharePoint Server vulnerability patched in its July 2026 Patch Tuesday cycle is now under active exploitation in the wild. Tracked as CVE-2026-50522, the flaw carries a CVSS score of 9.8 and stems from a deserialization of untrusted data vulnerability in Microsoft Office SharePoint, enabling an unauthenticated network attacker to achieve remote code execution. Microsoft credited DEVCORE researcher "splitline" for discovering and reporting the bug, and assigned it an exploitability assessment of "Exploitation More Likely," underscoring the elevated risk facing on-premises deployments of SharePoint Server Subscription Edition, 2019, and 2016.
Security researchers at watchTowr reported that threat actors began weaponizing CVE-2026-50522 almost immediately after a public proof-of-concept exploit was published, using a single unauthenticated request to extract SharePoint machine keys. "Attackers are pulling SharePoint machine keys via a single request," watchTowr noted on LinkedIn, warning that "patching is not enough; defenders should rotate credentials on any assets that may have been exposed." Defused Cyber corroborated the activity, observing .NET deserialization payloads being delivered to a SharePoint sign-in endpoint with no authentication headers attached, consistent with the unauthenticated attack profile of the vulnerability. Organizations should run a port scanner against their perimeter to confirm which SharePoint instances remain reachable from the internet.
The exploitation of CVE-2026-50522 follows two prior SharePoint flaws, CVE-2026-56164 (CVSS 5.3) and CVE-2026-58644 (CVSS 9.8), both of which were weaponized as zero-days before Microsoft shipped fixes in July 2026. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has since issued an advisory confirming that threat actors are chaining multiple SharePoint Server vulnerabilities, including CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644, to establish RCE, steal Internet Information Services (IIS) machine keys, and maintain persistence through deserialization techniques that facilitate downstream malware deployment.
Defenders are urged to apply the July 2026 SharePoint cumulative updates immediately, rotate all machine keys on affected servers, audit IIS for signs of compromise, and review sign-in endpoints for anomalous POST traffic. Because stolen machine keys can be reused to forge valid tokens long after patching, administrators should also verify that TLS configurations on exposed SharePoint front-ends remain intact using an SSL/TLS checker, and audit service account credentials with a password checker to identify any that may have been harvested during the active exploitation window.