Critical SharePoint Vulnerability CVE-2026-50522 Exploited After PoC Release

Researchers at watchTowr have reported active exploitation of yet another Microsoft SharePoint Server vulnerability patched as part of the July 2026 Patch Tuesday. The flaw in question is CVE-2026-50522 (CVSS score: 9.8) — a critical deserialization of untrusted data error in Microsoft Office SharePoint that allows an unauthorized attacker to execute code over a network.

According to Microsoft's description, an attacker holding at least Site Owner privileges can write and remotely execute arbitrary code on a SharePoint server. The attack vector is network-based: the vulnerability is exploited from the internet, and its low complexity means an attacker needs no deep knowledge of the system to achieve reliable results. The company assigned the vulnerability an “exploitation more likely” status and credited DEVCORE researcher splitline for the finding.

A patch isn't enough

The attacks began after a proof-of-concept was published. According to watchTowr, attackers are extracting SharePoint machine keys with a single request — and once they have the keys, they can maintain persistent access even after the update is installed. Hence the researchers' important warning: a patch alone is not enough; credentials and keys must be rotated on all potentially compromised assets.

Defused Cyber added that attackers appear to be delivering a .NET deserialization payload to the SharePoint login endpoint. The intercepted requests contain no authentication data, which is consistent with the vulnerability's unauthenticated profile.

Not the first in this line

CVE-2026-50522 is already the third SharePoint Server vulnerability to come under attack — following CVE-2026-56164 (CVSS 5.3) and CVE-2026-58644 (CVSS 9.8). The latter two were exploited as zero-days even before the July fixes were released.

The U.S. agency CISA has warned that attackers are leveraging several SharePoint Server vulnerabilities at once — including CVE-2026-32201, CVE-2026-45659, CVE-2026-56164 and CVE-2026-58644 — to gain unauthorized access to on-premises deployments. According to the agency, the issues affect all supported on-premises versions (Subscription Edition, 2019 and 2016) and enable not only remote code execution but also post-exploitation: stealing IIS machine keys, establishing persistence in the system and deploying malware.

Source: The Hacker News