Patching Is Not Enough: Critical SharePoint Deserialization RCE Under Active Exploitation (CVE-2026-50522)
Vulnerability Overview
CVE-2026-50522 is a critical remote code execution vulnerability in on-premises Microsoft SharePoint Server, caused by deserialization of untrusted data (CWE-502). It shipped in Microsoft's July 14, 2026 security updates with a CVSS 3.1 base score of 9.8 (Critical) and the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network-reachable, low complexity, no privileges, no user interaction, and total impact to confidentiality, integrity, and availability. Microsoft credited DEVCORE researcher "splitline" with the discovery. Following the release of a public proof-of-concept, security firm watchTowr reported active exploitation against on-premises deployments, with attackers stealing SharePoint machine keys to establish persistent access.
Attackers are pulling SharePoint machine keys via a single request. Because those keys enable forged authentication tokens that survive patching, defenders must rotate credentials and machine keys on any server that may have been exposed, not simply install the update.
Why SharePoint Keeps Getting Hit
On-premises SharePoint is close to an ideal target: it is internet-facing by design in many organizations, it stores the documents and institutional knowledge an intruder most wants, and it is deeply integrated with Active Directory and the wider Microsoft estate, which makes it an excellent pivot point. It is also operationally awkward to patch, since farms are business-critical, updates require care across multiple servers, and downtime is politically expensive. The result is a large population of exposed, slow-to-update servers holding valuable data.
That pressure is visible in the recent record. CVE-2026-50522 is the third SharePoint Server vulnerability to see active exploitation in this period, after CVE-2026-56164 and CVE-2026-58644, the latter two weaponized as zero-days before being fixed in July 2026. CISA has separately warned that threat actors are exploiting multiple SharePoint Server flaws, including CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644, to gain unauthorized access. If you run on-prem SharePoint, you are operating a product under sustained, coordinated attacker attention.
Technical Analysis
The underlying weakness is CWE-502, deserialization of untrusted data. Deserialization turns a byte stream back into an in-memory object. It becomes dangerous when an application reconstructs objects from attacker-controlled input without adequately restricting which types, properties, or code paths can be invoked. In .NET applications like SharePoint, an attacker who can supply a serialized payload can chain together legitimate classes ("gadgets") whose ordinary behavior, when triggered during object reconstruction, results in arbitrary command execution. The application never intended to run attacker code; it simply rebuilt an object graph that was designed to detonate.
Here, attacker-controlled serialized objects reach SharePoint's processing pipeline and are loaded server-side, yielding remote code execution in the context of the SharePoint application. The CVSS vector confirms the attack requires no authentication and no user interaction and is exploitable across the network, including from the internet for exposed farms.
One discrepancy is worth flagging rather than smoothing over. Microsoft's official CVSS vector specifies PR:N (no privileges required), and the CVE description states an unauthorized attacker can execute code over a network. However, at least one quoted Microsoft advisory statement in press coverage describes an attacker "authenticated as at least a Site Owner" writing arbitrary code, which would imply some privilege. That language may be carried over from a related SharePoint CVE in the same batch. Given that the authoritative vector and CVE description both indicate unauthenticated exploitation, and that active exploitation is being observed in the wild, treat this as unauthenticated for risk-planning purposes and verify specifics against MSRC.
Active Exploitation and Machine Key Theft
Microsoft initially tagged CVE-2026-50522 with an exploitability assessment of "Exploitation More Likely," and CISA's early SSVC data classified observed exploitation as none while judging the attack automatable with total technical impact. That assessment aged quickly. After a public PoC appeared, watchTowr reported detecting active exploitation against on-premises SharePoint deployments.
The attacker objective reported so far is the most consequential detail in this story: machine key theft. SharePoint machine keys (the ASP.NET validationKey and decryptionKey) are what the platform uses to sign and encrypt ViewState and related tokens. An attacker who obtains them can forge trusted payloads and authentication material at will, which means they retain a durable path back into the environment even after the vulnerability is patched. That is precisely the pattern seen in earlier SharePoint exploitation campaigns, and it is why watchTowr's guidance emphasizes that patching is not enough and credentials on potentially exposed assets must be rotated. Attackers are reportedly retrieving these keys with a single request, so a very short window of exposure is sufficient.
Affected Versions & Fixes
| Product | Status | Resolution |
|---|---|---|
| SharePoint Enterprise Server 2016 | Vulnerable | Apply July 2026 security update |
| SharePoint Server 2019 | Vulnerable | Apply July 2026 security update |
| SharePoint Server Subscription Edition | Vulnerable | Apply July 2026 security update |
| SharePoint Online (Microsoft 365) | Not affected | Service-side; this is an on-premises issue |
Updates are delivered through the usual channels (Windows Update, WSUS, Intune update rings, Autopatch) or manually from the Microsoft Update Catalog. Confirm the exact build for each server in your farm against MSRC.
Mitigation & Remediation
Treat this as an emergency change for any internet-facing farm:
- Apply the July 2026 SharePoint updates immediately. Patch every server in the farm and confirm the resulting build numbers, since a partially updated farm remains exposed.
- Rotate machine keys and credentials. This is the step defenders skip and attackers count on. Rotate ASP.NET machine keys on any server that may have been exposed, restart IIS so the new keys take effect, and rotate service accounts and other credentials reachable from the farm.
- Reduce exposure. Remove unnecessary internet exposure of on-premises SharePoint, place farms behind a WAF or authenticating reverse proxy, and restrict administrative interfaces to trusted networks.
- Hunt for compromise. Assume pre-patch exploitation on exposed servers. Review IIS and SharePoint logs for anomalous requests to deserialization-reachable endpoints, look for unexpected
w3wp.exechild processes such ascmd.exeorpowershell.exe, hunt for newly written.aspxfiles and web shells in SharePoint layouts directories, and check for signs of forged authentication tokens or unexplained privileged access. - Track the CISA guidance. Given ongoing exploitation across several SharePoint CVEs, follow CISA's SharePoint advisories for updated indicators and detection guidance.
The Bigger Picture
Two lessons stand out. The first is that unsafe deserialization remains one of the most reliable ways to turn a web request into code execution, and it keeps surfacing in mature enterprise platforms because the vulnerable pattern is deeply embedded in how these applications pass state around. The second, and more operationally important, is that remediation is not the same as recovery. When an exploit's first act is to steal cryptographic key material, applying the patch closes the door but leaves the attacker holding a copy of the key. Any incident response plan for a widely exploited web platform bug needs a credential and key rotation step baked in, executed on the assumption that exposure occurred, not after waiting for proof of it.
){kind=link}