Published: Wed 22 July 2026
Prepared by: Brandon Sawyer, Vulnerability Analyst
On 15 July 2026, Microsoft disclosed a critical vulnerability affecting on-premises Microsoft SharePoint servers assigned CVE-2026-50522. The vulnerability can allow a remote attacker to execute arbitrary code on vulnerable systems and has recently been observed to be actively exploited following the public release of proof-of-concept exploit code. Security teams should prioritise patching affected systems and assess whether any SharePoint environments have already been compromised.
CVE-2026-50522 is a deserialization of untrusted data vulnerability in Microsoft SharePoint. Microsoft has assigned the vulnerability a CVSSv3 score of 9.8 (Critical), reflecting the ease of exploitation and the potential impact on affected environments.
The flaw exists in the way SharePoint processes specially crafted serialized data. An attacker can send a malicious request to a vulnerable SharePoint server and trigger remote code execution, allowing them to run arbitrary code in the context of the SharePoint application. Microsoft has assessed exploitation as "more likely," and research organisations have reported seeing exploitation attempts shortly after public proof-of-concept code became available.
Researchers from watchTowr and Defused Cyber have observed activity consistent with attackers exploiting the vulnerability to access and steal SharePoint machine keys. These keys can be used to create valid authentication tokens, enabling attackers to maintain access to SharePoint environments even after the underlying vulnerability has been patched.
It is important to note that this vulnerability affects only on-premises SharePoint Server deployments. Organisations using SharePoint Online through Microsoft 365 are not affected, as Microsoft's cloud-hosted service receives security updates through its managed update process. However, organisations with hybrid SharePoint environments should ensure their on-premises SharePoint servers are patched and reviewed in line with Microsoft's recommendations, as the on-premises components remain vulnerable until updated.
Successful exploitation of CVE-2026-50522 can lead to the complete compromise of an affected SharePoint server. An attacker who gains code execution may be able to:
Of particular concern is the reported theft of SharePoint machine keys. Once these keys have been obtained, an attacker may be able to generate trusted authentication tokens and continue accessing SharePoint resources without needing to re-exploit the vulnerability. As a result, patching alone may not fully remediate an already-compromised environment.
Microsoft has released security updates to address CVE-2026-50522. Organisations should ensure all supported on-premises SharePoint servers are updated as a matter of priority. Minimum patched versions are:
| Product | Minimum Secure Version |
| SharePoint Enterprise Server 2016 | 16.0.5561.1001 |
| SharePoint Server 2019 | 16.0.10417.20175 |
| SharePoint Subscription Edition | 16.0.19725.20434 |
In addition to patching, organisations should consider the following actions:
If there is any indication that machine keys have been accessed or stolen, organisations should assume the environment may have been compromised before patching occurred. Affected systems should undergo incident response activities.
Organisations should review logs and endpoint telemetry for activity associated with SharePoint exploitation and post-compromise behaviour. Potential indicators of exploitation include:
Security teams should also investigate for indicators of compromise, including:
Given reports of machine key theft associated with active exploitation, organisations should not rely solely on successful patch deployment as evidence of safety. Any environment that was internet-facing and vulnerable prior to patching should be reviewed for signs of compromise and credential exposure.
MDR customers: Triskele Labs will continue tuning detections and analysing IoCs for behaviours consistent with the exploitation of CVE-2026-50522 across supported log sources.
Vulnerability Management customers: Environments are being assessed for vulnerable versions of SharePoint affected by CVE-2026-50522. Any findings will be communicated through priority channels.