Attackers are actively exploiting a critical remote code execution (RCE) vulnerability, CVE-2026-50522, in on-premise Microsoft SharePoint deployments. The primary objective of these attacks is to exfiltrate Internet Information Services (IIS) machine keys, which can grant long-term access to compromised systems.
Offensive security firm WatchTowr reported observing successful exploitation attempts against its global honeypot network on July 20. This activity occurred just hours after public exploit code for CVE-2026-50522 became available and less than a week after Microsoft confirmed active exploitation of two other SharePoint flaws: CVE-2026-56164, a privilege elevation vulnerability, and CVE-2026-58644, another RCE.
Threat intelligence firm Defused also identified what they now believe to be exploitation attempts for CVE-2026-50522 as early as July 17. These observed requests lacked authentication material, consistent with the unauthenticated nature of CVE-2026-50522. This contrasts with CVE-2026-58644, which Microsoft describes as requiring Site Owner authentication. If Defused's assessment is correct, it indicates that exploitation of CVE-2026-50522 began prior to the public release of a proof-of-concept exploit, but after Microsoft issued fixes for the vulnerability earlier in July. Microsoft had previously released fixes for CVE-2026-58644 in June 2026.
SharePoint servers are frequent targets for attackers due to their internet accessibility, the valuable organizational data they often contain, and their integration with other internal systems. While most internet-facing SharePoint instances are SharePoint Online, hosted and managed by Microsoft, approximately 1,500 self-managed, on-premises servers remain exposed. These are predominantly SharePoint 2019, with smaller numbers of 2016 and Subscription Edition instances, primarily located in the United States. The precise patch status of these self-managed servers is difficult to ascertain due to limitations in the SharePoint response header.
The US Cybersecurity and Infrastructure Security Agency (CISA) recently issued a warning regarding a series of SharePoint vulnerabilities under active attack. CISA urged organizations operating self-managed SharePoint instances to promptly apply security updates, verify that Antimalware Scan Interface (AMSI) integration is enabled and monitored for each SharePoint web application, implement various hardening measures, and actively hunt for and remediate any intrusion artifacts before rotating IIS machine keys.
Organizations that have not yet applied the SharePoint updates released on July 14 are particularly advised to follow these steps. WatchTowr emphasized that patching alone is insufficient; defenders must also rotate credentials on any assets that may have been exposed to mitigate the risk of persistent access.
