CVE-2026-50522 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-07-14

Added to CISA KEV: 2026-07-22 8 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review IIS/SharePoint logs, check for web shells, unauthorized access, and rotate exfiltrated SharePoint machine keys/MachineKey values.
Immediately apply the July 2026 Microsoft security updates (Subscription Edition >= 16.0.19725.20434, SharePoint 2019 >= 16.0.10417.20175, SharePoint 2016 >= 16.0.5561.1001). Rotating ASP.NET machine keys after patching is strongly advised given known key-theft exploitation.
Restrict public access to SharePoint web front-ends and administrative interfaces; deploy WAF signatures, enable AMSI integration, and use network segmentation/VPN gating for external access. Hunt for post-exploitation persistence (web shells, scheduled tasks, new service accounts).
Patch priority: EMERGENCY / P1 - patch within hours; treat any internet-exposed unpatched instance as potentially already compromised.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-50522 is a critical remote code execution (RCE) vulnerability affecting Microsoft Office SharePoint Server, specifically stemming from an insecure deserialization of untrusted data. With a CVSS score of 9.8, this vulnerability allows an unauthenticated, remote attacker to execute arbitrary code on the underlying server, making it a high-priority threat for any organization deploying SharePoint on-premises.

Exploitation

Active Exploitation: The vulnerability has been observed under active exploitation in the wild since at least July 2026.
Threat Actors: While specific advanced persistent threat (APT) groups have not been publicly named as the sole operators, its inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog indicates widespread use by various malicious actors.
Proof-of-Concept: Publicly available proof-of-concept (PoC) code and mass-scanning tools targeting this specific flaw have been released on platforms like GitHub, significantly lowering the barrier to entry for attackers.
Attack Prerequisites: The attack is network-based and does not require authentication or user interaction, allowing remote attackers to trigger the vulnerability directly against exposed SharePoint instances.

Affected Products & Patches

Affected Versions: The vulnerability impacts various on-premises versions of Microsoft SharePoint Server.
Patch Availability: Microsoft released security updates to address this vulnerability on July 14, 2026, as part of their Patch Tuesday cycle.
Mitigations: Organizations are strongly advised to apply the July 2026 security updates immediately. If patching is not immediately feasible, network segmentation and restricting public access to SharePoint administrative interfaces can reduce the attack surface.

Impact

System Access: Successful exploitation provides the attacker with the ability to execute arbitrary code with the privileges of the SharePoint service account, potentially leading to full system compromise.
Business Risk: For internet-facing deployments, this vulnerability poses a severe risk, as it allows attackers to steal sensitive data, exfiltrate SharePoint machine keys, move laterally within the network, or deploy ransomware, often resulting in significant data breaches and operational downtime.