Full Report
A third SharePoint Server flaw patched by Microsoft as part of its Patch Tuesday update for July 2026 has come under active exploitation, per watchTowr. The vulnerability in question is CVE-2026-50522 (CVSS score: 9.8), a critical deserialization of untrusted data in Microsoft Office SharePoint that could allow an unauthorized attacker to execute code over a network. Microsoft credited DEVCORE
Analysis Summary
# Vulnerability: Critical Deserialization RCE in Microsoft SharePoint Server
## CVE Details
- **CVE ID:** CVE-2026-50522
- **CVSS Score:** 9.8 (Critical)
- **CWE:** Deserialization of Untrusted Data (CWE-502)
## Affected Systems
- **Products:** Microsoft Office SharePoint Server (On-premises)
- **Versions:**
- SharePoint Server Subscription Edition
- SharePoint Server 2019
- SharePoint Server 2016
- **Configurations:** Vulnerability impacts on-premises deployments.
## Vulnerability Description
CVE-2026-50522 is a critical deserialization flaw. The vulnerability exists because SharePoint fails to properly validate or sanitize untrusted data during the deserialization process. An attacker with network access can send a specially crafted payload to the server. If successful, the server processes the malicious data, allowing the attacker to bypass security restrictions and execute arbitrary code.
## Exploitation
- **Status:** Exploited in the wild; Public Proof-of-Concept (PoC) available.
- **Complexity:** Low
- **Attack Vector:** Network
- **Authenticaton:** Per Microsoft, requires "Site Owner" level authentication; however, watchTowr reports active exploitation pulling machine keys via a single request.
## Impact
- **Confidentiality:** High (Full access to data and sensitive machine keys)
- **Integrity:** High (Ability to execute arbitrary code and modify system files)
- **Availability:** High (Potential for complete system takeover or service disruption)
## Remediation
### Patches
- **Microsoft July 2026 Patch Tuesday:** Administrators should apply the security updates specifically released for their version of SharePoint Server (Subscription Edition, 2019, or 2016).
### Workarounds
- **Credential Rotation:** Because attackers are known to be stealing Internet Information Services (IIS) machine keys to maintain persistence, patching alone is insufficient for compromised systems.
- **Secret Management:** Organizations must rotate machine keys and credentials on any assets that may have been exposed.
## Detection
- **Indicators of compromise:**
- Unauthorized requests for SharePoint machine keys.
- Unusual deserialization errors in application logs.
- Presence of web shells or unauthorized code in IIS directories.
- **Detection methods and tools:** Monitor network traffic for anomalous requests originating from "Site Owner" accounts and audit SharePoint logs for post-exploitation activities like machine key exports.
## References
- **Vendor Advisory:** hxxps[://]msrc[.]microsoft[.]com/update-guide/vulnerability/CVE-2026-50522
- **CISA KEV Catalog:** hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog
- **Security Research (watchTowr):** hxxps[://]thehackernews[.]com/2026/07/critical-sharepoint-rce-cve-2026-50522.html