Threat actors are actively exploiting a critical remote code execution (RCE) vulnerability in Microsoft SharePoint, designated CVE-2026-50522, to compromise on-premise deployments. The flaw, a deserialization-of-untrusted-data issue, allows unauthenticated attackers to execute arbitrary code over a network.
Microsoft released patches for CVE-2026-50522 in its July security updates. While the company did not initially mark the vulnerability as actively exploited, it did note an increased likelihood of exploitation. Cybersecurity firm watchTowr confirmed active exploitation shortly after a proof-of-concept (PoC) exploit became publicly available.
On July 20, watchTowr identified a valid PoC for CVE-2026-50522. Within hours, their global honeypot network, Attacker Eye, recorded successful exploitation attempts utilizing this PoC. The firm observed attackers stealing machine keys, a tactic that allows them to maintain persistent access to compromised systems even after the underlying SharePoint servers are patched.
Earlier, on July 17, the threat intelligence company Defused had detected an "undocumented SharePoint deserialization vector" being used in attacks. At that time, Defused could not definitively link the activity to a specific vulnerability. However, the company later stated that these attacks were likely driven by exploitation of CVE-2026-50522.
A PowerShell-based PoC exploit for CVE-2026-50522, developed by security researcher Janggggg, is publicly available on GitHub. This PoC attempts to achieve RCE by delivering a malicious .NET BinaryFormatter payload. The payload is crafted as a cookie within a forged SecurityContextToken, which is then posted to SharePoint's /_trust/default.aspx endpoint as part of a WS-Federation sign-in response. If a vulnerable deserialization path processes this token, the payload executes arbitrary code on the SharePoint server.
Janggggg published the PoC on the same day watchTowr began detecting exploitation attempts. However, it remains unconfirmed whether the observed attacks directly utilized this specific publicly available exploit.
While applying the latest SharePoint security updates will mitigate the vulnerability, watchTowr advises organizations to take additional precautions. Specifically, defenders should rotate credentials on any assets that may have been exposed to potential compromise, given the attackers' objective of stealing machine keys for persistent access.
