A critical remote code execution (RCE) vulnerability in Microsoft SharePoint, identified as CVE-2026-50522, is now under active exploitation following the public release of proof-of-concept (PoC) exploit code. The flaw, which carries a CVSS score of 9.8, was addressed by Microsoft in its July 2026 Patch Tuesday updates.
According to watchTowr researchers, active exploitation of CVE-2026-50522 targeting on-premises Microsoft SharePoint servers was observed shortly after the public exploit code became available. Attackers are reportedly leveraging the vulnerability to steal SharePoint machine keys through a single request, which could allow for persistent access even after systems are patched. Security experts are advising organizations not only to apply Microsoft's updates but also to rotate machine keys and any other potentially exposed credentials to mitigate the risk of long-term compromise.
watchTowr identified the PoC exploit code on July 20th. Within hours, their global honeypot network, Attacker Eye, detected and captured exploitation attempts utilizing this PoC that successfully compromised target systems. Cybersecurity firm Defused Cyber also reported observing threat actors exploiting CVE-2026-50522 to deliver a .NET deserialization payload via a SharePoint sign-in endpoint. These observed attacks reportedly require no authentication, aligning with the vulnerability's unauthenticated remote code execution profile.
CVE-2026-50522 is a deserialization flaw that, in its initially documented form, allowed authenticated attackers with Site Owner privileges to execute arbitrary code remotely. However, subsequent analysis and observed exploitation indicate that it can be triggered without authentication or user interaction. This vulnerability is considered a matched pair with CVE-2026-58644, both stemming from the deserialization of untrusted data. CVE-2026-50522 was publicly demonstrated at Pwn2Own Berlin, where a working exploit was provided to Microsoft, yet the official advisory initially listed its exploit maturity as "unknown."
This incident follows several other SharePoint vulnerabilities that have been added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog this year. In early July, CISA added CVE-2026-45659, a high-severity SharePoint Server RCE flaw (CVSS 8.8) patched in May 2026, which also stemmed from deserialization of untrusted data and did not require complex conditions for exploitation.
Prior to that, in April 2026, CISA added CVE-2026-32201, a SharePoint Server spoofing vulnerability (CVSS 6.5) likely related to cross-site scripting (XSS), which could allow attackers to view or modify exposed information. In March 2026, CVE-2026-20963, another deserialization of untrusted data flaw in Microsoft Office SharePoint, was added to the KEV catalog, allowing an authorized attacker to execute code over a network.
Given the potential impact, organizations, particularly those with internet-facing SharePoint servers, are urged to prioritize testing and applying the latest security updates immediately, and to consider credential rotation for any potentially compromised assets. Microsoft has not disclosed the widespread nature of the current exploitation.
