CVE-2026-50522: Actively Exploited SharePoint Server Deserialization RCE with Machine-Key Theft

CVE-2026-50522 is a critical remote code execution vulnerability affecting on-premises Microsoft SharePoint Server deployments. The vulnerability, rated CVSS 9.8, stems from the unsafe deserialization of untrusted data and can allow attackers to execute arbitrary code remotely on vulnerable SharePoint servers. Microsoft addressed the flaw as part of its July 2026 security updates.

On July 20, 2026, publicly available proof-of-concept exploit code was released, substantially lowering the barrier to exploitation. Within hours, security researchers observed attackers using the published technique against internet-facing SharePoint systems. Observed exploitation included delivering malicious .NET deserialization payloads through a SharePoint sign-in endpoint and extracting SharePoint machine keys in a single request. Although Microsoft’s advisory describes exploitation involving Site Owner privileges, captured attack traffic reportedly contained no authentication material, suggesting that the currently exploited vector may be reachable without prior authentication.

The theft of SharePoint and IIS machine keys presents a significant long-term risk because attackers may use the exposed cryptographic material to generate trusted payloads, maintain access, and continue executing code even after the underlying vulnerability has been patched. Organizations operating on-premises SharePoint should therefore treat exposed servers as potentially compromised, immediately apply Microsoft’s security updates, rotate SharePoint and IIS machine keys and other potentially exposed credentials, and investigate for evidence of exploitation or post-compromise activity.