Attackers are exploiting the CVE-2026-50522 SharePoint RCE to target on-premises Microsoft SharePoint servers. Successful exploitation can expose IIS machine keys and preserve access after teams install the security update.
Key findings include:
The public exploit targets SharePoint’s sign-in flow with a malicious .NET deserialization payload.
Affected organizations should patch, investigate their servers, and remove intrusion artifacts.
Teams should remove active key harvesters before rotating exposed machine keys and credentials.
CISA added CVE-2026-50522 to its Known Exploited Vulnerabilities catalog on July 22, 2026.
The CVE-2026-50522 SharePoint RCE is a critical vulnerability in on-premises Microsoft SharePoint Server. It results from deserialization of untrusted data and carries a CVSS score of 9.8.
Microsoft released security updates for the vulnerability on July 14, 2026. The Microsoft security advisory lists these affected products:
SharePoint Enterprise Server 2016
SharePoint Server 2019
SharePoint Server Subscription Edition
Microsoft confirms that the Enterprise Server 2016 update also applies to SharePoint Server 2016. However, its published materials conflict on authentication requirements.
Microsoft’s CVSS vector assigns PR:N, meaning attackers need no privileges. In addition, the Zero Day Initiative says that exploitation requires no authentication.
In contrast, Microsoft’s FAQ says an attacker must authenticate as at least a Site Owner. The vendor advisory has not resolved this inconsistency.
Because the requirements conflict, organizations should not assume that authentication controls prevent exploitation. Therefore, they should prioritize every internet-reachable affected server.
How attackers exploit CVE-2026-50522 SharePoint RCE
A public proof of concept targets SharePoint’s WS-Federation sign-in flow. First, it places a malicious .NET BinaryFormatter payload inside a forged SecurityContextToken cookie. Then, it posts the token to /_trust/default.aspx.
The payload can execute code if the vulnerable component deserializes the token. BleepingComputer considered the exploit structurally plausible but did not test it independently.
On July 20, 2026, watchTowr identified public exploit code for CVE-2026-50522. The company said its honeypots captured successful exploitation attempts within hours. However, BleepingComputer could not confirm whether those incidents used the published exploit.
Defused reported possible exploitation on July 17. However, independent researchers have not confirmed that earlier timeline.
Why SharePoint machine key theft matters
After gaining code execution, attackers reportedly extract IIS machine keys from the compromised environment. SharePoint uses these cryptographic keys to protect and validate authentication-related data.
Attackers who obtain the keys can forge valid tokens and impersonate SharePoint users. Consequently, patching may close the entry point without invalidating stolen keys.
This persistence risk changes the required response. Therefore, security teams must investigate servers, remove attacker-controlled artifacts, and replace exposed cryptographic material.
Patching remains essential. However, an update cannot remove malware, invalidate stolen secrets, or complete an incident investigation.
Which SharePoint versions are affected?
Microsoft lists the following on-premises SharePoint releases and fixed builds. Administrators can use these values to verify each server:
Product
Fixed build
Security update
SharePoint Enterprise Server 2016
16.0.5561.1001
KB5002891
SharePoint Server 2019
16.0.10417.20175
KB5002883
SharePoint Server Subscription Edition
16.0.19725.20434
KB5002882
Microsoft states that KB5002891 also applies to SharePoint Server 2016. Therefore, administrators should verify the installed build rather than trust an update job. They should also confirm the status of every farm server.
Learn about an earlier exploited SharePoint flaw and the endpoint and identity controls enterprises can consider.
How to remediate CVE-2026-50522 SharePoint RCE
Organizations should treat an exposed SharePoint server as a potential security incident. This step becomes critical when a server remains internet-facing after exploit publication.
Apply the Microsoft security update
Install the correct update for the deployed SharePoint version. Then, verify the fixed build on every server.
Reduce external exposure
Avoid direct internet exposure wherever possible. Otherwise, use an authenticated Layer 7 reverse proxy or an equivalent control.
Investigate before rotating keys
Review IIS and SharePoint logs for unusual requests. Also investigate w3wp.exe activity, web shells and machine-key access.
Remove intrusion artifacts
Eradicate malicious files, processes, persistence mechanisms and key-harvesting tools. Only then should teams rotate exposed keys.
Rotate exposed secrets
Replace affected IIS or ASP.NET machine keys. In addition, rotate credentials that attackers could have accessed.
Restart IIS and continue monitoring
Restart IIS after the key rotation. Afterward, monitor suspicious authentication attempts and follow-on activity.
Strengthen SharePoint protections
Enable AMSI integration for every SharePoint web application. On Subscription Edition, use Full Mode where operationally feasible.
Full request-body scanning is available only in SharePoint Server Subscription Edition. Therefore, SharePoint Server 2016 and 2019 cannot use this mode.
CISA advises organizations to remove machine-key harvesters before rotating keys. Otherwise, an active harvester could collect the replacement keys.
Is the exploitation of CVE-2026-50522 confirmed?
Yes. CISA added CVE-2026-50522 to its Known Exploited Vulnerabilities catalog on July 22, 2026. Inclusion means that CISA has evidence of active exploitation.
CISA assigned the vulnerability a July 25, 2026, KEV due date. Under BOD 26-04, qualifying publicly exposed federal civilian assets require rapid remediation.
CISA’s July 22 notice confirms the addition. In addition, the KEV entry provides its status and due date.
As of July 27, 2026, Microsoft’s advisory did not mark the vulnerability as exploited. However, CISA and independent honeypot observations establish active exploitation.
As of the same date, the cited sources had not published an affected-organization count. They had not attributed the activity to a specific threat actor.
In addition, the sources had not quantified data theft resulting from forged tokens. Therefore, organizations should avoid unsupported claims about campaign scale or attribution.
Is this part of a wider SharePoint attack wave?
CVE-2026-50522 follows CVE-2026-58644, CVE-2026-56164, and CVE-2026-45659, which attackers have also exploited. This activity suggests sustained interest in exposed servers, authentication paths, and unsafe deserialization. Therefore, organizations should treat SharePoint hardening as an ongoing priority.
Shorter patch cycles can reduce the exposure window. In addition, organizations should restrict external access, strengthen logging, and conduct regular compromise assessments.
Featured resource
Hexnode UEM for Patch Management
Learn how Hexnode centralizes patch deployment, compliance tracking and visibility across supported Windows and macOS endpoints.
Hexnode does not patch SharePoint or provide SharePoint Server-specific incident response. Therefore, organizations need Microsoft updates and dedicated server-investigation tools.
However, Hexnode UEM can monitor and manage operating system and application updates on enrolled Windows devices. This capability can support Windows PCs that administrators use to access SharePoint.
In addition, Hexnode XDR provides endpoint investigation and containment capabilities. Security teams can search endpoint activity and isolate affected endpoints.
Hexnode UEM supports Windows 10 and Windows 11 PCs and tablets. Meanwhile, Hexnode XDR provides security capabilities for Windows endpoints.
These endpoint capabilities do not cover Windows Server systems that host SharePoint. Therefore, use dedicated SharePoint patching, server monitoring, and forensic tools.
FAQs
Can a reverse proxy replace the Microsoft security update?
No. A reverse proxy can reduce exposure, but it cannot remove CVE-2026-50522 from an unpatched SharePoint server. Organizations must still install the update and investigate previously exposed servers.
Should teams investigate administrator endpoints after a SharePoint compromise?
Yes, when evidence indicates follow-on activity beyond the SharePoint server. Prioritize administrator endpoints showing suspicious authentication, processes, or network connections.
The bottom line
Organizations should patch the CVE-2026-50522 SharePoint RCE immediately. However, patching represents only the first response step. Stolen machine keys make this both an incident-response and patch-management problem.
Security teams must investigate exposed servers, remove malicious artifacts, and rotate compromised machine keys and credentials. Then, they should restart IIS and monitor for continued access.
Make endpoint patching easier to control
Start a free 14-day Hexnode trial to automate supported endpoint updates, monitor compliance and reduce patching gaps.
I write at the intersection of technology, process, and people, focusing on explaining complex products with clarity. I break down tools, systems, and workflows without any noise, jargon, or the hype.
