Microsoft has confirmed that a third SharePoint Server vulnerability addressed in the July 2026 Patch Tuesday update is now under active exploitation, following the public release of a proof-of-concept exploit. The flaw, tracked as CVE-2026-50522 and carrying a critical CVSS score of 9.8, enables remote code execution through deserialization of untrusted data, and security vendors are reporting real-world attacks targeting on-premises deployments.
CVE-2026-50522: A Critical Deserialization Flaw in SharePoint Server
CVE-2026-50522 is a deserialization of untrusted data vulnerability in Microsoft Office SharePoint Server that allows an unauthenticated attacker to execute arbitrary code over a network. The vulnerability was discovered and reported by researcher “splitline” from DEVCORE. An attacker authenticated as at least a Site Owner could write arbitrary code to inject and execute commands remotely on the target SharePoint Server. The attack vector is network-based, remotely exploitable from the internet, and requires low complexity, meaning an attacker does not need significant prior knowledge of the system to achieve repeatable success. Microsoft assigned CVE-2026-50522 an exploitability assessment of “Exploitation More Likely.”
Active Exploitation Observed After Public PoC Release
Security vendor watchTowr has detected active exploitation of CVE-2026-50522 against on-premises Microsoft SharePoint deployments following the release of a public proof-of-concept exploit. Attackers are pulling SharePoint machine keys through a single request, enabling them to maintain persistent access to compromised systems. watchTowr emphasized that patching alone is insufficient and that defenders should rotate credentials on any assets that may have been exposed. Separately, Defused Cyber reported that threat actors are likely exploiting CVE-2026-50522 to deliver a .NET deserialization payload to a SharePoint sign-in endpoint. The captured requests carry no authentication material, matching the unauthenticated profile of the vulnerability.
Third SharePoint Vulnerability Exploited in July 2026 Patch Cycle
CVE-2026-50522 is the third SharePoint Server vulnerability to witness active exploitation after the July 2026 Patch Tuesday updates. The other two flaws, CVE-2026-56164 (CVSS score: 5.3) and CVE-2026-58644 (CVSS score: 9.8), were weaponized as zero-days prior to being fixed. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that threat actors are exploiting multiple SharePoint Server vulnerabilities, including CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644, to gain unauthorized access to on-premises instances. These vulnerabilities affect all supported on-premises SharePoint Server versions, including Subscription Edition, 2019, and 2016. The attacks involve establishing remote code execution and post-exploitation activities such as stealing Internet Information Services (IIS) machine keys and performing deserialization techniques to gain persistence and deploy malware.
What Affected Organizations Should Do Now
Organizations running on-premises Microsoft SharePoint Server should immediately apply the July 2026 security updates if they have not already done so. Given that patching alone may not be sufficient, defenders must also rotate all machine keys and credentials on any systems that may have been exposed. It is critical to monitor for signs of post-exploitation activity, including unauthorized access to sign-in endpoints, anomalous deserialization payloads, and unusual requests targeting IIS machine keys. Deploying a multi-layer endpoint protection solution with real-time threat detection and behavioral analysis can help identify and block exploitation attempts. Organizations should also conduct a thorough review of SharePoint Server logs for indicators of compromise and consider implementing network segmentation to limit the blast radius of any successful attack. For environments where immediate patching is not possible, applying virtual patching or intrusion detection rules that specifically target deserialization attacks against SharePoint endpoints is a prudent interim measure.
