Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC
A critical SharePoint Server flaw patched by Microsoft as part of its Patch Tuesday update for July 2026 has come under active exploitation, per watchTowr. The vulnerability in question is CVE-2026-50522 (CVSS score: 9.8), a critical deserialization of untrusted data in M…
Intelligence analysis by Llama
Microsoft has patched a critical SharePoint Server flaw as part of its Patch Tuesday update for July 2026, but the vulnerability has already come under active exploitation. WatchTowr has detected exploitation of the flaw against on-premises Microsoft SharePoint deployments following the release of a public proof-of-concept (PoC) exploit.
Imagine you have a super powerful computer that can do anything you want, but someone else can also control it remotely. That's what's happening with the SharePoint Server flaw. Attackers can steal machine keys to maintain persistent access, and Microsoft has patched the issue, but it's already being exploited.
Analysis
A Third SharePoint Server Flaw in July 2026 Patch Tuesday Update
Microsoft has patched a third SharePoint Server flaw as part of its Patch Tuesday update for July 2026. The vulnerability in question is CVE-2026-50522 (CVSS score: 9.8), a critical deserialization of untrusted data in Microsoft Office SharePoint that could allow an unauthorized attacker to execute code over a network.
Microsoft credited DEVCORE researcher "splitline" with discovering and reporting the flaw. "In a network-based attack, an attacker authenticated as at least a Site Owner, could write arbitrary code to inject and execute code remotely on the SharePoint Server," Redmond said in an advisory released last week.
The tech giant also tagged CVE-2026-50522 with an exploitability assessment of "Exploitation More Likely." In a post shared on LinkedIn, watchTowr said it has detected active exploitation of the shortcoming against on-premises Microsoft SharePoint deployments following the release of a public proof-of-concept (PoC) exploit, allowing attackers to steal machine keys to maintain persistent access.
"Attackers are pulling SharePoint machine keys via a single request," the security vendor said. "Patching is not enough; defenders should rotate credentials on any assets that may have been exposed."
Defused Cyber has also disclosed that threat actors are likely exploiting CVE-2026-50522 to deliver a .NET deserialization payload to a SharePoint sign-in endpoint. "The captured requests carry no authentication material, matching 50522's unauthenticated profile," it said.
CVE-2026-50522 is the third vulnerability in SharePoint Server after CVE-2026-56164 (CVSS score: 5.3) and CVE-2026-58644 (CVSS score: 9.8) to witness active exploitation efforts, with the latter two weaponized as zero-days prior to them being fixed in July 2026.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has since warned that threat actors are exploiting multiple SharePoint Server vulnerabilities, including CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644, to gain unauthorized access to on-premises instances.
"These vulnerabilities affect all supported on-premises SharePoint Server versions (Subscription Edition, 2019, and 2016) and involve establishing remote code execution (RCE) and post-exploitation activities, such as stealing Internet Information Services (IIS) machine keys and performing deserialization techniques, to gain persistence and deploy malware," the agency said.
Key points
- Microsoft has patched a critical SharePoint Server flaw as part of its Patch Tuesday update for July 2026.
- The vulnerability in question is CVE-2026-50522 (CVSS score: 9.8), a critical deserialization of untrusted data in Microsoft Office SharePoint.
- WatchTowr has detected active exploitation of the shortcoming against on-premises Microsoft SharePoint deployments following the release of a public proof-of-concept (PoC) exploit.
- Defused Cyber has also disclosed that threat actors are likely exploiting CVE-2026-50522 to deliver a .NET deserialization payload to a SharePoint sign-in endpoint.
Microsoft has patched the vulnerability, and watchTowr has detected active exploitation efforts. This highlights the importance of patching and rotating credentials on affected assets to prevent persistent access.
The exploitation of this vulnerability highlights the risks of not patching and rotating credentials on affected assets, which can lead to persistent access and further attacks.
