CVE-2026-50522: Microsoft SharePoint Critical RCE Actively Exploited, Attackers Steal IIS Machine Keys for Persistent Access

Microsoft SharePoint CVE-2026-50522 deserialization RCE is under active exploitation. Attackers steal IIS machine keys in a single request and can forge authentication tokens for persistent access. Patching alone is not enough; rotate keys.

On 14 July 2026, Microsoft patched a critical remote code execution vulnerability in SharePoint Server, CVE-2026-50522 (CVSS 9.8), in the July Patch Tuesday. The issue is unsafe deserialization of untrusted data (CWE-502), allowing unauthenticated attackers to execute arbitrary code over the network. Threat intelligence firms watchTowr and Defused Cyber confirmed active in-the-wild exploitation, with successful attempts appearing hours after a public PoC was released.

Incident Overview

CVE-2026-50522 affects all supported on-premises SharePoint Server versions:

• SharePoint Enterprise Server 2016
• SharePoint Server 2019
• SharePoint Server Subscription Edition

This is the fourth SharePoint vulnerability confirmed exploited in the wild in the past month. CVE-2026-58644, CVE-2026-56164, and CVE-2026-45659 were previously weaponized as zero-days. CISA has warned organizations that threat actors are exploiting multiple SharePoint vulnerabilities to gain unauthorized access.

Technical Details

Mechanism

The flaw is in SharePoint's deserialization of untrusted data. Attackers send a crafted request carrying a .NET deserialization payload to the SharePoint login endpoint. The server incorrectly reconstitutes attacker-supplied objects and executes arbitrary code on the server.

Per Defused Cyber analysis, captured attack requests carried no authentication material, matching the unauthenticated profile of CVE-2026-50522.

Attackers Steal Machine Keys

watchTowr observed on its global honeypot network that attackers use this vulnerability to steal SharePoint/IIS machine keys in a single request. These keys sign and validate authentication tokens. Once leaked, attackers can:

• Forge valid authentication tokens
• Impersonate any user
• Maintain persistent access after patches are applied

CVSS Score

| Version | Score | Severity | Vector | | --- | --- | --- | --- | | CVSS 3.1 | 9.8 | Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |

Impact Assessment

Active Exploitation

• 17 July: Defused honeypot first captured suspected zero-day attack traffic
• 20 July: Security researcher Janggggg published PoC exploit code
• 20 July: watchTowr honeypots captured successful exploitation hours after PoC release
• 22 July: CISA issued a warning confirming exploitation of multiple SharePoint vulnerabilities

Exposure

Per Censys mapping, about 1,500 on-premises SharePoint servers are internet-facing, primarily in the United States. SharePoint response-header limitations prevent a precise patch-status assessment.

Remediation

Immediate Patch

Apply the Microsoft July security updates. Fixed versions:

• 16.0.5561.1001 (SharePoint 2016)
• 16.0.10417.20175 (SharePoint 2019)
• 16.0.19725.20434 (Subscription Edition)

Critical: Rotate Machine Keys

watchTowr stated explicitly: "Patching is not enough". For SharePoint servers that were internet-exposed before patching, you must:

• Rotate SharePoint/IIS machine keys
• Review and rotate all related credentials
• Assume machine keys may have been stolen

Detection and Hardening

• Monitor SharePoint login endpoints for unauthenticated deserialization payload requests
• Enable AMSI integration and set Request Body Scan to Full mode
• Restrict internet exposure of on-premises SharePoint servers
• Hunt for unexpected web shells or anomalous authentication tokens

References

• Microsoft Security Response Center
• The Hacker News: Active Exploitation Confirmed
• SecurityWeek: Fourth SharePoint Vulnerability Exploited
• Help Net Security: Patch Then Rotate Keys