Triskele Labs Blog

Critical Microsoft SharePoint Remote Code Execution - CVE-2026-50522

Written by  Brandon Sawyer | Jul 22, 2026 5:37:05 AM

Published: Wed 22 July 2026

Prepared by: Brandon Sawyer, Vulnerability Analyst

Purpose

On 15 July 2026, Microsoft disclosed a critical vulnerability affecting on-premises Microsoft SharePoint servers assigned CVE-2026-50522. The vulnerability can allow a remote attacker to execute arbitrary code on vulnerable systems and has recently been observed to be actively exploited following the public release of proof-of-concept exploit code. Security teams should prioritise patching affected systems and assess whether any SharePoint environments have already been compromised.

Vulnerability details

CVE-2026-50522 is a deserialization of untrusted data vulnerability in Microsoft SharePoint. Microsoft has assigned the vulnerability a CVSSv3 score of 9.8 (Critical), reflecting the ease of exploitation and the potential impact on affected environments.

The flaw exists in the way SharePoint processes specially crafted serialized data. An attacker can send a malicious request to a vulnerable SharePoint server and trigger remote code execution, allowing them to run arbitrary code in the context of the SharePoint application. Microsoft has assessed exploitation as "more likely," and research organisations have reported seeing exploitation attempts shortly after public proof-of-concept code became available.

Researchers from watchTowr and Defused Cyber have observed activity consistent with attackers exploiting the vulnerability to access and steal SharePoint machine keys. These keys can be used to create valid authentication tokens, enabling attackers to maintain access to SharePoint environments even after the underlying vulnerability has been patched.

The vulnerability affects the following supported on-premises SharePoint deployments:
  • SharePoint Enterprise Server 2016
  • SharePoint Server 2019
  • SharePoint Server Subscription Edition

It is important to note that this vulnerability affects only on-premises SharePoint Server deployments. Organisations using SharePoint Online through Microsoft 365 are not affected, as Microsoft's cloud-hosted service receives security updates through its managed update process. However, organisations with hybrid SharePoint environments should ensure their on-premises SharePoint servers are patched and reviewed in line with Microsoft's recommendations, as the on-premises components remain vulnerable until updated.  

Impact

Successful exploitation of CVE-2026-50522 can lead to the complete compromise of an affected SharePoint server. An attacker who gains code execution may be able to:

  • Access, modify or delete SharePoint content and documents.
  • Deploy malware, web shells or other persistence mechanisms.
  • Steal SharePoint or IIS machine keys.
  • Forge authentication tokens and impersonate legitimate users.
  • Move laterally within the environment using the compromised server as a foothold
  • Maintain access after patching if cryptographic keys or credentials have already been stolen. 

Of particular concern is the reported theft of SharePoint machine keys. Once these keys have been obtained, an attacker may be able to generate trusted authentication tokens and continue accessing SharePoint resources without needing to re-exploit the vulnerability. As a result, patching alone may not fully remediate an already-compromised environment.

Mitigation

Microsoft has released security updates to address CVE-2026-50522. Organisations should ensure all supported on-premises SharePoint servers are updated as a matter of priority. Minimum patched versions are:

Product Minimum Secure Version
SharePoint Enterprise Server 2016 16.0.5561.1001
SharePoint Server 2019 16.0.10417.20175
SharePoint Subscription Edition 16.0.19725.20434

In addition to patching, organisations should consider the following actions:

  • Rotate SharePoint and IIS machine keys where compromise is suspected.
  • Reset any service account credentials associated with affected SharePoint environments.
  • Review privileged accounts and rotate credentials that may have been exposed.
  • Restrict internet exposure of on-premises SharePoint servers where business requirements allow.
  • Perform a compromise assessment to identify any signs of post-exploitation activity.

If there is any indication that machine keys have been accessed or stolen, organisations should assume the environment may have been compromised before patching occurred. Affected systems should undergo incident response activities. 

Detection

Organisations should review logs and endpoint telemetry for activity associated with SharePoint exploitation and post-compromise behaviour. Potential indicators of exploitation include:

  • Requests to SharePoint trust or federation endpoints, particularly /_trust/default.aspx.
  • Suspicious WS-Federation authentication requests.
  • Evidence of .NET deserialization payloads being submitted to SharePoint services.
  • Requests containing forged or abnormal Security Context Tokens.

Security teams should also investigate for indicators of compromise, including:

  • Unexplained access to machine key files or cryptographic material.
  • Suspicious PowerShell activity originating from SharePoint servers.
  • Newly created administrator accounts.
  • Unexpected web shell files or executable content within SharePoint directories.
  • Anomalous authentication activity or evidence of token forgery.
  • Lateral movement activity originating from SharePoint infrastructure. 

Given reports of machine key theft associated with active exploitation, organisations should not rely solely on successful patch deployment as evidence of safety. Any environment that was internet-facing and vulnerable prior to patching should be reviewed for signs of compromise and credential exposure.

MDR customers: Triskele Labs will continue tuning detections and analysing IoCs for behaviours consistent with the exploitation of CVE-2026-50522 across supported log sources.

Vulnerability Management customers: Environments are being assessed for vulnerable versions of SharePoint affected by CVE-2026-50522. Any findings will be communicated through priority channels.

References