Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC

Microsoft’s July 2026 Patch Tuesday addressed dozens of security vulnerabilities across Windows, Microsoft Office, Azure services, and SharePoint Server. While most organizations immediately focused on two SharePoint zero-days that had already been exploited before patches became available, another critical vulnerability initially received comparatively little attention. That changed only days later.

Security researchers at watchTowr confirmed that attackers had begun exploiting CVE-2026-50522, a critical remote code execution vulnerability in Microsoft SharePoint Server, within hours of a public proof-of-concept (PoC) exploit appearing online. The attacks were not merely attempting opportunistic exploitation. According to the researchers, successful compromises were being used to extract SharePoint machine keys, enabling attackers to establish long-term persistence that can survive routine patching if organizations fail to rotate compromised secrets.

The development marks yet another escalation in what has become one of the busiest months for SharePoint security in recent years. Following the exploitation of CVE-2026-56164 and CVE-2026-58644, organizations now face a third critical vulnerability being actively weaponized against on-premises SharePoint deployments. Collectively, these attacks demonstrate a clear trend: internet-facing SharePoint servers remain a high-value target for threat actors seeking privileged access into enterprise environments.

Unlike many recent SharePoint flaws that relied on authentication bypasses or privilege escalation chains, CVE-2026-50522 stems from one of the most dangerous classes of software vulnerabilities: deserialization of untrusted data. Improper handling of serialized objects has repeatedly led to high-impact remote code execution vulnerabilities across enterprise software because it allows attackers to manipulate how applications reconstruct complex objects in memory. When deserialization occurs before sufficient validation, carefully crafted object graphs can trigger arbitrary code execution during the reconstruction process itself.

Microsoft assigned the vulnerability a CVSS 9.8 (Critical) severity rating and categorized exploitation as “Exploitation More Likely” even before attacks were publicly observed. That assessment has now proven accurate as researchers continue to detect exploitation attempts against vulnerable SharePoint servers exposed to the internet.

Understanding CVE-2026-50522

CVE-2026-50522 is classified as CWE-502: Deserialization of Untrusted Data, a vulnerability category that has historically resulted in numerous enterprise remote code execution bugs across Java, .NET, PHP, and other application frameworks.

Serialization converts an in-memory object into a structured representation that can later be reconstructed. SharePoint uses serialization extensively for authentication workflows, token processing, distributed state management, and communication between application components. When deserializing externally supplied data, every property, type, and object graph must be validated before reconstruction occurs.

If validation is incomplete or absent, an attacker can supply malicious serialized data containing gadget chains that invoke unintended methods during deserialization. These gadget chains ultimately execute attacker-controlled code under the privileges of the vulnerable application.

Microsoft describes CVE-2026-50522 as a deserialization of untrusted data vulnerability affecting on-premises Microsoft SharePoint Server that enables remote code execution over the network. The vulnerability affects supported releases of SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition prior to Microsoft’s July 2026 security updates.

Where the Vulnerability Exists

Technical information released by the Zero Day Initiative provides significantly more insight into the vulnerable code path than Microsoft’s public advisory.

According to ZDI, the flaw resides within the SessionSecurityTokenHandler component responsible for processing security tokens during SharePoint authentication workflows. The vulnerability arises because user-controlled data is insufficiently validated before being deserialized, allowing attackers to manipulate the object reconstruction process. From a defensive perspective, this location is particularly significant.

Authentication token handlers typically execute before an authenticated user session has been fully established. Any vulnerability occurring during token parsing therefore executes extremely early in the request processing pipeline. This often provides attackers with an opportunity to reach vulnerable functionality before many authorization controls become relevant.

That architectural characteristic helps explain why deserialization vulnerabilities within authentication frameworks frequently have severe security consequences.

Authentication Confusion: What Is Required?

One of the most confusing aspects of CVE-2026-50522 is that authoritative sources currently disagree on whether authentication is required. Microsoft’s advisory states that exploitation requires an attacker authenticated as at least a Site Owner.

However, Microsoft’s own published CVSS vector assigns PR:N, indicating no privileges required. The National Vulnerability Database reproduces this same vector. Meanwhile, the Zero Day Initiative explicitly states that authentication is not required, and Defused Cyber observed exploitation attempts containing no authentication material, consistent with unauthenticated attack traffic.

There are several possible explanations. Microsoft’s advisory language may describe one supported exploitation scenario while later research uncovered an unauthenticated path. Alternatively, successful exploitation may involve chaining CVE-2026-50522 with another weakness, allowing authentication requirements to be bypassed in practice. Another possibility is that Microsoft’s advisory text simply does not reflect the implementation details ultimately leveraged by public exploit code.

Until Microsoft formally clarifies the discrepancy, defenders should assume the more conservative position: any internet-accessible SharePoint deployment should be considered at risk.

Public Proof-of-Concept Accelerates Exploitation

The transition from patched vulnerability to active exploitation occurred remarkably quickly. watchTowr reported identifying public proof-of-concept exploit code on July 20. Within hours, the company’s global honeypot infrastructure began detecting exploitation attempts leveraging the vulnerability. According to the researchers, attackers rapidly shifted from experimentation to operational exploitation almost immediately after exploit code became publicly available.

Rapid weaponization has become increasingly common across enterprise software vulnerabilities. Once a technically accurate PoC is published, sophisticated threat actors rarely need to perform extensive vulnerability research themselves. Instead, they can integrate publicly available exploit logic into automated scanning infrastructure capable of identifying and attacking exposed systems at internet scale. This significantly compresses the defender’s response window.

Organizations that previously measured patch deployment timelines in weeks increasingly face adversaries capable of exploiting newly published vulnerabilities within hours.

Technical Analysis of the Public Exploit

Public reporting indicates that available proof-of-concept code delivers a malicious .NET BinaryFormatter payload encapsulated inside a forged SecurityContextToken transmitted through a WS-Federation sign-in response targeting the SharePoint endpoint:

/_trust/default.aspx

If the vulnerable SharePoint server processes the malicious security token through the affected deserialization path, attacker-controlled objects are reconstructed in memory, resulting in arbitrary code execution under the SharePoint service account.

Although Microsoft has not released implementation details, the attack aligns with well-understood .NET deserialization techniques. BinaryFormatter has long been recognized as a high-risk serialization mechanism because object reconstruction can invoke methods before application-level validation occurs. Microsoft has discouraged its use for years due to the frequency with which unsafe deserialization has resulted in critical remote code execution vulnerabilities across enterprise software.

The exploit therefore does not rely on memory corruption, buffer overflows, or complex race conditions. Instead, it abuses trusted application functionality by convincing SharePoint to deserialize attacker-controlled objects that should never have been accepted in the first place.

Why Attackers Want IIS Machine Keys

watchTowr’s most significant finding was not simply that attackers achieved remote code execution. Instead, researchers observed attackers extracting SharePoint machine keys immediately after compromise. Machine keys are fundamental cryptographic secrets used by ASP.NET applications for authentication token generation, ViewState protection, anti-forgery validation, and other security mechanisms.

If attackers obtain these keys, they may be able to generate authentication material that appears cryptographically valid to the compromised SharePoint deployment. Rather than repeatedly exploiting the original vulnerability, attackers can leverage forged tokens to regain access even after the software vulnerability itself has been patched. Applying Microsoft’s July security update removes the vulnerable deserialization path, but it does not invalidate cryptographic secrets that may already have been stolen.

Consequently, organizations responding to a suspected compromise should not view patch installation as sufficient remediation. If exploitation occurred before patching, defenders should assume authentication secrets may have been exposed and treat the incident as a full credential compromise requiring secret rotation and broader incident response.

SharePoint Remains a High-Value Enterprise Target

CVE-2026-50522 represents the latest chapter in an increasingly aggressive campaign targeting on-premises SharePoint deployments. During July alone, multiple SharePoint vulnerabilities have transitioned from disclosure to active exploitation, including previously exploited flaws such as CVE-2026-58644 and CVE-2026-56164. CISA has warned organizations that attackers are using these vulnerabilities to establish remote code execution, steal IIS machine keys, maintain persistence, and ultimately deploy malware within enterprise environments.

For many organizations, SharePoint servers integrate directly with Active Directory, enterprise authentication infrastructure, document management systems, and internal business workflows. Successful compromise can therefore provide attackers with privileged access to sensitive corporate information while also creating opportunities for lateral movement deeper into enterprise networks.

For defenders, the lesson is becoming increasingly clear. Internet-facing SharePoint servers now demand the same operational urgency traditionally reserved for externally exposed VPN gateways, Exchange servers, and domain controllers. When critical vulnerabilities such as CVE-2026-50522 emerge, the window between disclosure, proof-of-concept publication, and real-world exploitation is now measured in hours rather than weeks.

Exploitation Chain: From a Single Request to Persistent Access

While CVE-2026-50522 is fundamentally a deserialization vulnerability, the activity observed in the wild suggests attackers are less interested in the initial remote code execution itself than in what comes immediately afterward.

watchTowr reported that compromised servers were being used to retrieve ASP.NET machine keys, allowing attackers to establish persistent access that survives simple patch deployment. In other words, remote code execution is only the first stage of the attack. The long-term objective appears to be obtaining cryptographic secrets that can later be abused to generate trusted authentication material.

A typical attack sequence observed from public reporting is as follows:

1. The attacker identifies an internet-facing SharePoint Server running a vulnerable build.
2. A crafted WS-Federation request containing a malicious serialized .NET object is sent to SharePoint’s authentication endpoint.
3. The vulnerable deserialization routine reconstructs attacker-controlled objects.
4. Arbitrary code executes under the SharePoint/IIS worker process.
5. The attacker extracts ASP.NET machine keys and other application secrets.
6. Additional tooling or web shells may be deployed depending on the attacker’s objectives.
7. Even after Microsoft patches are installed, stolen machine keys can potentially be abused to forge valid authentication tokens unless organizations rotate them after compromise. (bleepingcomputer.com)

Unlike commodity ransomware campaigns that immediately encrypt systems, this behavior indicates a focus on maintaining privileged, long-term access into enterprise environments.

Indicators of Compromise (IoCs)

At the time of writing, security researchers have not published attacker-controlled IP addresses, domains, malware hashes, or web shell hashes associated specifically with CVE-2026-50522. Publishing speculative indicators would create unnecessary false positives.

Instead, defenders should focus on behavioral indicators confirmed through public research.

HTTP Indicators

Investigate unexpected POST requests targeting:

/_trust/default.aspx

Particularly those containing:

• WS-Federation authentication messages
• Large serialized payloads
• BinaryFormatter serialized objects
• SecurityContextToken values that appear unusually large or malformed

Public PoCs leverage forged WS-Federation responses carrying malicious BinaryFormatter payloads directed at this endpoint.

IIS Logs

Review IIS logs for:

• Repeated POST requests to:

/_trust/default.aspx

• Unexpected HTTP 500 responses during authentication
• High-volume requests from unfamiliar IPs
• Requests immediately preceding worker process crashes or application pool recycling

Correlate these requests with subsequent suspicious PowerShell execution or process creation.

Process Creation

The IIS worker process:

w3wp.exe

should rarely launch child processes.

Investigate if it spawns:

powershell.exe
cmd.exe
rundll32.exe
mshta.exe
regsvr32.exe
certutil.exe
cscript.exe
wscript.exe

These are common indicators of successful post-exploitation rather than exploitation itself.

PowerShell Logging

Review:

• Event ID 4104
• Event ID 4103

Look for:

• Base64-encoded commands
• Reflection loading
• Memory-only execution
• Download cradle activity
• AMSI bypass attempts

Windows Security Events

Useful events include:

• 4624 (Successful Logon)
• 4625 (Failed Logon)
• 4648 (Explicit Credential Usage)
• 4672 (Special Privileges Assigned)
• 4688 (Process Creation)

Although none uniquely identify CVE-2026-50522 exploitation, correlating these with IIS activity can reveal successful compromise.

ASP.NET Machine Key Changes

Investigate:

• Unexpected access to web.config
• Changes to machineKey entries
• Export or backup of configuration files
• Unauthorized reads of IIS configuration

Any evidence that machine keys were accessed should be treated as a credential compromise.

Threat Hunting Guidance

Security teams should proactively search for systems exhibiting the following sequence:

• POST request to /_trust/default.aspx
• IIS worker process executes PowerShell
• Configuration files accessed shortly afterward
• Machine keys exported
• Authentication activity originating from previously unseen accounts or systems

This sequence is significantly stronger than relying on any single indicator.

Detection Engineering

Organizations using Microsoft Defender for Endpoint, Microsoft Sentinel, or other EDR platforms should create detections that correlate:

• SharePoint IIS logs
• PowerShell Script Block Logging
• Sysmon Process Creation
• Windows Security Events
• ASP.NET configuration access

Behavioral correlation provides substantially higher fidelity than attempting to detect the exploit payload itself.

Sigma Detection Example

The following Sigma rule detects suspicious child processes launched by IIS. It is not specific to CVE-2026-50522, but it is useful for identifying successful exploitation.

title: Suspicious IIS Worker Process Spawning PowerShell
status: experimental
logsource:
  category: process_creation
detection:
  selection:
    ParentImage|endswith:
      - '\w3wp.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
      - '\certutil.exe'
  condition: selection
level: high

Microsoft’s Mitigation Guidance

Microsoft recommends immediately installing the July 2026 security updates for:

• SharePoint Server 2016
• SharePoint Server 2019
• SharePoint Server Subscription Edition

However, organizations that suspect compromise should go further.

They should:

• Rotate ASP.NET machine keys.
• Rotate service account credentials if exposure cannot be ruled out.
• Review SharePoint and IIS logs for exploitation attempts.
• Hunt for persistence mechanisms.
• Validate application configuration integrity.
• Investigate any abnormal authentication tokens generated after suspected compromise.

Timeline

July 14, 2026

Microsoft releases security updates for CVE-2026-50522 as part of Patch Tuesday. The vulnerability is rated Critical (CVSS 9.8) with an “Exploitation More Likely” assessment.

July 17, 2026

Defused Cyber detects suspicious SharePoint exploitation activity affecting honeypots, although the exact vulnerability is not yet identified.

July 20, 2026

Public proof-of-concept exploit code becomes available. Defused associates the observed attacks with CVE-2026-50522.

July 21, 2026

watchTowr confirms active exploitation shortly after the PoC is published and reports attackers stealing ASP.NET machine keys for persistence.

Final Thoughts

The rapid weaponization of CVE-2026-50522 demonstrates how quickly high-impact enterprise vulnerabilities move from disclosure to real-world exploitation. Public proof-of-concept code reduced the barrier to entry, enabling attackers to compromise vulnerable SharePoint deployments within hours of its release.

Perhaps the most concerning aspect is not the initial remote code execution itself, but the observed theft of ASP.NET machine keys. Once these cryptographic secrets are exposed, simply applying Microsoft’s patches may not fully remove an attacker’s foothold. Organizations should therefore treat successful exploitation as a broader credential compromise, validating authentication infrastructure, rotating machine keys, and conducting a thorough incident response investigation.

With four SharePoint vulnerabilities now exploited in the wild within a single month, defenders should assume that internet-facing SharePoint servers will continue to attract sustained attention from threat actors. Rapid patch deployment, continuous monitoring, and post-compromise credential hygiene are no longer optional but essential components of securing on-premises SharePoint environments.