A critical deserialization vulnerability in Microsoft SharePoint Server — tracked as CVE-2026-50522 with a CVSS score of 9.8 — is being actively exploited in the wild, marking the fourth SharePoint flaw to face in-the-wild exploitation within a single month. The vulnerability was patched by Microsoft on July 14, 2026 as part of its Patch Tuesday release. Threat intelligence firm Defused first observed exploitation attempts on July 17, with security firm WatchTowr confirming active exploitation on July 20 — the same day proof-of-concept code was publicly released by researcher Janggggg. CISA has since added CVE-2026-50522 to its Known Exploited Vulnerabilities catalog and directed Federal Civilian Executive Branch agencies to apply mitigations on an urgent deadline.
CVE-2026-50522 is a remote code execution flaw stemming from deserialization of untrusted data. An attacker authenticated as at least a SharePoint Site Owner can send a malicious .NET BinaryFormatter payload directly targeting the SharePoint Server, enabling arbitrary code injection and remote execution. Microsoft describes the exploitation complexity as low, meaning attackers do not require deep system knowledge to successfully carry out an attack. The resulting compromise can enable malware installation, data theft, and lateral movement through connected network infrastructure.
What distinguishes CVE-2026-50522 from its three recent predecessors — CVE-2026-58644, CVE-2026-56164, and CVE-2026-45659 — is the specific post-exploitation technique threat actors are deploying. WatchTowr confirmed that attackers are pulling SharePoint machine keys via a single request, using them to establish long-term persistence that survives both patching and conventional credential rotation. Machine keys, unlike user passwords, allow attackers to forge authentication tokens and impersonate the server itself — creating a form of identity-layer persistence that can outlast every standard incident response action an organisation takes. As WatchTowr researchers explicitly warned: patching is not enough. Defenders must rotate credentials on any asset that may have been exposed.
Security expert John Strand explained that when an attacker steals a machine key they are no longer impersonating a user but impersonating the machine itself — a fundamentally more privileged and durable position. Roy Katmor of Orchid Security described it as trust-layer theft, noting that a software vulnerability becomes an identity persistence problem when machine keys are involved. WatchTowr's team described the exploit as having ToolShell-class impact — a reference to the summer 2025 ToolShell campaign in which ransomware and state-linked groups compromised hundreds of SharePoint customers including multiple US federal agencies.
Apply Microsoft's July 14 Patch Tuesday update immediately for CVE-2026-50522. Beyond patching, rotate machine keys and all credentials on any SharePoint instance or connected asset that may have been exposed. Enable Antimalware Scan Interface and deploy Microsoft Defender for Endpoint protection. Conduct a post-exploitation review to identify what trust material, identities, and access paths may have been compromised before the patch was applied. Organisations that delay rotation should assume compromise rather than assume safety.