SharePoint CVE-2026-50522 Exploited: Patch, Rotate Keys

Microsoft SharePoint Server administrators have a new July patch item to treat as an incident-response priority. CVE-2026-50522 is a critical remote code execution flaw in Microsoft Office SharePoint, and fresh exploitation reporting says attackers are now using public proof-of-concept code against on-premises deployments to steal machine keys and preserve access.^[1][3]

The important nuance is that Microsoft’s own advisory data still lists the issue as “Exploitation More Likely,” not exploited, while the active-attack claim comes from external monitoring summarized by The Hacker News, including watchTowr and Defused Cyber observations.^[1][3] That difference matters for wording, but not for triage: an exposed on-premises SharePoint server with July patches missing should be handled as a high-risk asset now.

What SharePoint admins should do now

CVE-2026-50522 is a deserialization of untrusted data vulnerability. NVD records it with a CVSS 3.1 score of 9.8 and the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning network exploitation, low attack complexity, no user interaction, and high impact to confidentiality, integrity, and availability.^[2] Microsoft lists the affected products as SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.^[1]

The relevant July security updates are KB5002882 for Subscription Edition, KB5002883 for SharePoint Server 2019, and KB5002891 for SharePoint Enterprise Server 2016.^[1] SharePoint Online customers are not the audience for these server patches; this is mainly a problem for organizations still operating on-premises farms, hybrid deployments with on-premises roles, or internet-reachable test and legacy servers.

Patching is the first step, but it may not be the last one. The exploitation reports say attackers are pulling SharePoint machine keys, which can let them maintain access after a vulnerable endpoint is fixed if defenders only install the update and move on.^[3] That is why this story connects directly to the earlier SharePoint CVE-2026-58644 KEV warning and the broader Microsoft July Patch Tuesday SharePoint zero-day pattern: the platform is being attacked as a persistence surface, not just as a one-time RCE target.

After applying the update, administrators should rotate ASP.NET and SharePoint machine keys for servers that were exposed before patching, restart IIS, and review whether any farm nodes, service accounts, web applications, or backup images still carry old secrets. CISA’s SharePoint hardening alert for the July exploitation wave specifically calls out IIS machine-key theft, deserialization techniques, persistence, and malware deployment across supported on-premises SharePoint Server versions.^[4]

For triage, look for unusual requests to SharePoint sign-in and application pages, unexpected w3wp.exe child processes, recently written ASPX files, modified web.config files, unfamiliar timer jobs, new local or domain accounts, and outbound connections from SharePoint servers that do not match normal integrations. If you find signs of compromise, preserve IIS logs and SharePoint ULS logs before cleanup, because key rotation and rebuild work can erase useful evidence.

The response posture should be closer to a web-shell investigation than a routine patch ticket. The KnowledgeDeliver zero-day web-shell case is a useful comparison: once attackers can pair deserialization with stolen validation material or server-side code execution, defenders have to rebuild trust in both the application layer and the secrets that validate requests.

For now, CVE-2026-50522 is not listed in CISA KEV, and Microsoft’s advisory does not mark it as exploited. But with public PoC activity and external reports of active harvesting, waiting for a KEV entry before rotating keys is the wrong threshold for exposed SharePoint Server farms.

References

1. Microsoft Security Response Center, “CVE-2026-50522: Microsoft SharePoint Remote Code Execution Vulnerability,” released July 14, 2026.
2. NIST National Vulnerability Database, “CVE-2026-50522 Detail,” published July 14, 2026.
3. The Hacker News, “Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC,” July 21, 2026.
4. CISA, “CISA Urges SharePoint Hardening After New Exploitations,” last revised July 16, 2026.