Critical SharePoint RCE Flaw Exploited to Steal Machine Keys
Hackers are actively exploiting a critical vulnerability in Microsoft SharePoint to steal machine keys and maintain access even after affected servers are patched.
Intelligence analysis by Llama
A critical vulnerability in Microsoft SharePoint is being exploited by hackers to steal machine keys and maintain access to affected servers even after they are patched. The vulnerability, CVE-2026-50522, allows remote attackers to execute code over a network without authentication.
Imagine you have a super important key that unlocks a safe. Hackers are finding a way to steal this key and use it to get into the safe even after the lock has been fixed. This is a big problem because it means that even if the lock is fixed, the hackers can still get in.
Analysis
A Critical Vulnerability in SharePoint
The critical CVE-2026-50522 vulnerability in Microsoft SharePoint is being actively exploited by hackers to steal machine keys and maintain access to affected servers even after they are patched. This vulnerability allows remote attackers to execute code over a network without authentication, making it a significant security risk. Microsoft describes the issue as a deserialization-of-untrusted-data flaw that can be exploited to execute code on a vulnerable server.
Exploitation and Impact
WatchTowr, an offensive security company, has observed that hackers started to leverage CVE-2026-50522 against on-premise vulnerable SharePoint deployments immediately after a valid proof-of-concept (PoC) exploit became public. The researchers note that the attackers are stealing machine keys that allow them to maintain long-term access on breached systems. Defused, an early warning threat intelligence company, detected an undocumented SharePoint deserialization vector being used in attacks as early as July 17, but could not link the activity to a flaw. Yesterday, the company said that the attacks were likely driven by exploiting the CVE-2026-50522 SharePoint vulnerability.
Publicly Available Exploit
At least one PowerShell demonstrative exploit for CVE-2026-50522 is available on GitHub from security researcher Janggggg. The PoC attempts to trigger remote code execution by delivering a malicious .NET ‘BinaryFormatter’ payload as the cookie of a forged ‘SecurityContextToken’ within a WS-Federation sign-in response posted to SharePoint's ‘/_trust/default.aspx’ endpoint. If the token is processed by a vulnerable deserialization path, the payload results in arbitrary code execution on the SharePoint server.
Key points
- A critical vulnerability in Microsoft SharePoint is being actively exploited by hackers to steal machine keys and maintain access to affected servers even after they are patched.
- The vulnerability, CVE-2026-50522, allows remote attackers to execute code over a network without authentication.
- Microsoft describes the issue as a deserialization-of-untrusted-data flaw that can be exploited to execute code on a vulnerable server.
- WatchTowr has observed that hackers started to leverage CVE-2026-50522 against on-premise vulnerable SharePoint deployments immediately after a valid proof-of-concept (PoC) exploit became public.
- Defused detected an undocumented SharePoint deserialization vector being used in attacks as early as July 17, but could not link the activity to a flaw.
If this development plays out positively, it could lead to increased awareness and patching of vulnerabilities in critical systems, reducing the risk of exploitation and maintaining access to affected servers.
The realistic downside risks or failure modes of this development include the potential for hackers to continue exploiting the vulnerability, leading to further breaches and access to affected servers.
