Critical SharePoint Flaw CVE-2026-50522 Now Actively Exploited Following Public PoC Release

A critical Microsoft SharePoint vulnerability patched in July 2026 is now under active exploitation after a public proof-of-concept exploit surfaced online, putting thousands of on-premises deployments at immediate risk.

The flaw, tracked as CVE-2026-50522 and carrying a near-maximum CVSS score of 9.8, allows attackers to execute arbitrary code remotely on vulnerable SharePoint Servers. Security vendors have confirmed real-world attacks are already underway, with threat actors stealing machine keys to maintain persistent access across compromised systems.

---

CVE-2026-50522: What the Vulnerability Does and Who Discovered It

CVE-2026-50522 is a deserialization of untrusted data vulnerability in Microsoft Office SharePoint. Microsoft patched it as part of its July 2026 Patch Tuesday update and credited DEVCORE researcher "splitline" with discovering and responsibly reporting the flaw.

Microsoft described the attack scenario in stark terms. "In a network-based attack, an attacker authenticated as at least a Site Owner could write arbitrary code to inject and execute code remotely on the SharePoint Server," the company stated in its advisory.

The vulnerability carries the lowest possible complexity rating. "The attack complexity is Low because an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component," Microsoft explained. That combination of remote exploitability and low complexity makes CVE-2026-50522 particularly dangerous in the hands of even moderately skilled threat actors.

Microsoft had also tagged the flaw with an exploitability assessment of "Exploitation More Likely" at the time of patching — a label that has since proven accurate.

Why Deserialization Vulnerabilities Are Especially Dangerous

Deserialization flaws are among the most severe vulnerability classes in enterprise software. When an application deserializes untrusted data without proper validation, it can be tricked into executing attacker-controlled code during that process — often with the same privileges as the running service. In SharePoint's case, that means system-level code execution on a server that frequently sits at the heart of an organisation's document management and internal communications infrastructure.

Understanding why cybersecurity matters for enterprise infrastructure is fundamental to appreciating the scale of risk that a flaw of this nature introduces — particularly when the affected platform holds sensitive business data and is accessible from the internet.

---

Active Exploitation Confirmed After Public PoC Release

Security vendor watchTowr confirmed active exploitation of CVE-2026-50522 against on-premises SharePoint deployments in a post shared on LinkedIn. The exploitation followed the release of a public proof-of-concept exploit that significantly lowered the barrier for attackers to weaponize the flaw.

"Attackers are pulling SharePoint machine keys via a single request," watchTowr warned. The firm added a critical advisory that organisations should not treat patching alone as sufficient: "Patching is not enough; defenders should rotate credentials on any assets that may have been exposed."

Security firm Defused Cyber added further technical detail to the picture. Threat actors are likely exploiting CVE-2026-50522 to deliver a .NET deserialization payload to a SharePoint sign-in endpoint. "The captured requests carry no authentication material, matching 50522's unauthenticated profile," the firm disclosed — a detail that directly contradicts Microsoft's initial framing of the attack as requiring Site Owner-level authentication and raises additional concern about the flaw's real-world attack surface.

The Machine Key Theft Problem

The theft of IIS machine keys is the most consequential element of this exploitation chain. Those keys are used to encrypt and validate data within a SharePoint environment. An attacker who obtains them can forge authentication tokens and maintain persistent access even after passwords are changed — making remediation far more complex than applying a single patch.

This is not a theoretical risk. Organisations that were internet-facing during the exploitation window must assume that machine keys may already be in adversary hands, regardless of whether any other indicators of compromise have been detected. A structured vulnerability management process that includes post-exploitation assessment — not just patch deployment — is essential in scenarios like this one.

A Broader SharePoint Exploitation Wave

CVE-2026-50522 is now the third SharePoint Server vulnerability from the July 2026 Patch Tuesday cycle to face active exploitation. The other two — CVE-2026-56164, carrying a CVSS score of 5.3, and CVE-2026-58644, also rated 9.8 — were both weaponized as zero-days before Microsoft issued fixes.

The pattern is significant. Three critical or high-severity flaws from a single patch cycle being actively exploited within weeks of disclosure suggests that threat actors are conducting sustained, targeted research against SharePoint's attack surface. Organisations running on-premises SharePoint should treat this as a sustained campaign, not an isolated incident.

---

CISA Escalates Response as Federal Deadline Looms

The U.S. Cybersecurity and Infrastructure Security Agency moved quickly to escalate the threat. On July 22, 2026 — just one day after exploitation was publicly confirmed — CISA added CVE-2026-50522 to its Known Exploited Vulnerabilities catalog. Federal Civilian Executive Branch agencies have been ordered to apply the available patch by July 25, 2026.

CISA had already issued a broader warning about the wave of SharePoint exploitation, flagging multiple vulnerabilities including CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644 as being actively abused to gain unauthorised access to on-premises SharePoint instances.

The agency described the scope of post-exploitation activity in alarming detail. "These vulnerabilities affect all supported on-premises SharePoint Server versions — Subscription Edition, 2019, and 2016 — and involve establishing remote code execution and post-exploitation activities, such as stealing Internet Information Services machine keys and performing deserialization techniques, to gain persistence and deploy malware," CISA stated.

What Post-Exploitation Looks Like in Practice

The scenario facing SharePoint administrators involves silent persistence, credential theft, and lateral movement that can continue long after the initial intrusion point is closed. Attackers who have secured machine keys can operate inside a compromised environment indefinitely, forging tokens, impersonating users, and pivoting to connected systems — all without triggering conventional authentication alerts.

Effective threat management and incident response planning must account for this kind of durable, credential-based persistence. Incident response teams should not assume that patching closes the intrusion window — forensic investigation of affected systems is necessary to determine whether machine keys were exfiltrated before the patch was applied.

For additional technical context on the CISA Known Exploited Vulnerabilities catalog and how federal agencies respond to critical disclosures, the CISA KEV catalog provides a continuously updated reference that security teams can use to prioritise remediation efforts.

---

What Organisations Should Do Now

The convergence of a critical CVSS score, confirmed active exploitation, and a public PoC leaves little room for delay. Security teams managing on-premises SharePoint environments should treat this as an emergency requiring immediate action.

• Apply Microsoft's July 2026 patch immediately across all supported SharePoint Server versions — Subscription Edition, 2019, and 2016 — and do not wait for a scheduled maintenance window given confirmed active exploitation.
• Rotate IIS machine keys and all associated credentials on any SharePoint instance that may have been internet-facing or exposed, since attackers who have already stolen machine keys can maintain access even after patching.
• Monitor SharePoint sign-in endpoints for anomalous deserialization activity and unauthenticated requests carrying .NET payloads, using the technical indicators disclosed by Defused Cyber as a baseline for threat hunting.

Patching is necessary but not sufficient. Any SharePoint environment that was exposed during the exploitation window must be treated as potentially compromised. Machine key rotation, credential reissuance, and forensic log review are not optional steps — they are the minimum baseline for responsible remediation given what is now known about this attack chain.