Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC

Severity

Critical

Microsoft has disclosed that CVE-2026-50522, a critical remote code execution (RCE) vulnerability affecting Microsoft SharePoint Server, is being actively exploited in the wild. The flaw, caused by insecure deserialization of untrusted data, allows attackers to execute arbitrary code remotely on vulnerable on-premises SharePoint servers.

According to Microsoft’s advisory, the vulnerability can be exploited over the network with low attack complexity. Although successful exploitation requires an attacker to have at least Site Owner privileges, Microsoft has assessed the vulnerability as “Exploitation More Likely” due to its ease of exploitation and potential impact.

Following the public release of a proof-of-concept (PoC) exploit, watchTowr observed active attacks targeting on-premises SharePoint deployments. Attackers have been seen stealing Internet Information Services (IIS) machine keys through a single request, enabling persistent access even after security updates are applied. Security researchers have also reported attempts to deliver malicious .NET deserialization payloads to SharePoint sign-in endpoints without requiring authentication.

CVE-2026-50522 is the third SharePoint Server vulnerability reported to be under active exploitation after CVE-2026-56164 and CVE-2026-58644. Additionally, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that multiple SharePoint Server vulnerabilities are being exploited to gain unauthorized access, establish persistence, steal IIS machine keys, and deploy malware on affected systems.

CVE ID	Summary	CVSS Score
CVE-2026-50522	An insecure deserialization vulnerability in Microsoft SharePoint Server that allows remote code execution. Attackers can exploit the flaw to execute arbitrary code and steal IIS machine keys for persistent access.	9.8 (Critical)

Affected Products

The vulnerability affects supported Microsoft SharePoint Server on-premises versions, including:

SharePoint Server Subscription Edition
SharePoint Server 2019
SharePoint Server 2016

Recommendation

Organizations and SharePoint administrators are strongly advised to take the following actions to reduce the risk of compromise:

Apply Microsoft’s July 2026 security updates immediately to address CVE-2026-50522.
Rotate IIS machine keys, service account credentials, and other sensitive credentials on servers that may have been exposed, as patching alone may not remove attacker persistence.
Review SharePoint and Windows event logs for signs of unauthorized access, suspicious deserialization activity, or unexpected requests to SharePoint sign-in endpoints.
Restrict SharePoint administrative privileges, monitor internet-facing SharePoint servers closely, and isolate affected systems if compromise is suspected.
Continue monitoring Microsoft’s and CISA’s security advisories for additional guidance and indicators of compromise (IOCs).

Source

https://thehackernews.com/2026/07/critical-sharepoint-rce-cve-2026-50522.html