Microsoft's July 2026 Patch Tuesday delivered a record 622 vulnerabilities, but one flaw stands out for SharePoint administrators: CVE-2026-50522, a critical deserialization remote code execution vulnerability (CVSS 9.8) now under active exploitation. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to the Known Exploited Vulnerabilities (KEV) catalog on July 22, giving federal agencies until July 25 to remediate. If you run on-premises SharePoint Server, patching alone is not enough — you must also rotate machine keys on any potentially exposed systems.

Vulnerability Details

CVE-2026-50522 is a deserialization of untrusted data vulnerability in Microsoft Office SharePoint Server. An authenticated attacker with at least Site Owner permissions can send a crafted request to execute arbitrary code on the SharePoint server over the network.

Property	Value
CVE ID	CVE-2026-50522
CVSS v3.1 Score	9.8 (Critical)
Attack Vector	Network (AV:N)
Attack Complexity	Low (AC:L)
Privileges Required	Low (PR:L) — Site Owner or higher
User Interaction	None (UI:N)
Scope	Unchanged
Impact	High (Confidentiality, Integrity, Availability)
Exploitability Assessment	Exploitation More Likely
Discovered By	DEVCORE researcher "splitline"
CISA KEV Added	July 22, 2026
Patch Deadline (FCEB)	July 25, 2026

The vulnerability affects all supported on-premises SharePoint Server versions:

• SharePoint Server Subscription Edition
• SharePoint Server 2019
• SharePoint Server 2016

SharePoint Online (Microsoft 365) is not affected — Microsoft handles patching for the cloud service.

Impact Assessment

This is the third SharePoint RCE actively exploited in July 2026 alone, following:

• CVE-2026-56164 (CVSS 5.3, unauthenticated privilege escalation, exploited as zero-day)
• CVE-2026-58644 (CVSS 9.8, deserialization RCE, exploited as zero-day)

CISA warns that threat actors are chaining these vulnerabilities to gain unauthorized access, establish persistence, and deploy malware. The attack chain typically involves:

1. Initial access via deserialization RCE (CVE-2026-50522 or CVE-2026-58644)
2. Theft of IIS machine keys for persistent authentication bypass
3. Lateral movement and malware deployment

WatchTowr researchers reported observing active exploitation against on-premises SharePoint deployments immediately after a public proof-of-concept (PoC) was released. Attackers are pulling SharePoint machine keys via a single unauthenticated request — a finding corroborated by Defused Cyber, which captured unauthenticated exploitation attempts matching CVE-2026-50522's profile.

Key takeaway: The vulnerability requires Site Owner privileges in Microsoft's official advisory, but real-world exploitation appears to bypass this requirement in certain configurations. Treat it as effectively unauthenticated until proven otherwise in your environment.

Affected Systems

Any organization running on-premises SharePoint Server is at risk. This includes:

• Enterprises using SharePoint for document management, intranet portals, or custom applications
• Government agencies (FCEB agencies bound by CISA Binding Operational Directive 22-01)
• Organizations with hybrid SharePoint deployments where on-premises servers are internet-accessible
• Environments where SharePoint Server 2016 or 2019 remain in use — both reached end of extended support in July 2026 with no Extended Security Updates (ESU) program available

Mitigation & Patching

1. Apply the July 2026 Security Update Immediately

Download and install the relevant update for your SharePoint version from the Microsoft Security Update Guide. The patch is included in the July 2026 cumulative update for each supported version.

2. Enable AMSI in Full Mode

Microsoft's advisory notes that enabling the Antimalware Scan Interface (AMSI) in Full Mode on the SharePoint server blunts the attack. This provides a defense-in-depth layer while you validate the patch.

3. Rotate Machine Keys — Critical Step

Patching does not remediate stolen machine keys. If an attacker extracted the IIS machine key before patching, they can forge authentication tokens and maintain persistent access. After patching:

Coordinate key rotation across the entire farm. All servers must share the same keys. Test in a staging environment first — mismatched keys break authentication.

4. Audit for Compromise

Check for indicators of compromise (IoCs):

• Unusual POST requests to /_layouts/15/ endpoints with serialized payloads
• Event ID 4624 (logon) with anomalous account usage
• New or modified machine keys in web.config files
• Unexpected service accounts or scheduled tasks

Microsoft Defender for Endpoint and Sentinel have detection rules for CVE-2026-50522 exploitation. Enable them if available.

5. Network Segmentation

Restrict inbound access to SharePoint servers:

• Block internet-facing access to SharePoint Central Administration
• Limit SharePoint web application access to trusted IP ranges
• Enforce MFA for all administrative accounts

Detection

Suricata Rule

YARA Rule

Sigma Rule

Frequently Asked Questions

Q: Does this affect SharePoint Online / Microsoft 365?
No. Microsoft manages patching for the cloud service. Only on-premises SharePoint Server is affected.

Q: My SharePoint 2016/2019 is end-of-life. What now?
No Extended Security Updates (ESU) program exists for SharePoint Server 2016 or 2019. You must upgrade to SharePoint Server Subscription Edition or migrate to SharePoint Online immediately. Running unpatched EOL software with an actively exploited RCE is unacceptable risk.

Q: Is patching sufficient?
No. If machine keys were stolen before patching, attackers retain persistent access. You must rotate machine keys on all farm servers after patching.

Q: How do I know if I was compromised?
Review IIS logs for anomalous POST requests to /_layouts/15/ endpoints with serialized payloads. Check for unexpected machine key changes, new service accounts, or scheduled tasks. Run the Sigma/Suricata rules above against historical logs.

Q: Can I mitigate without patching immediately?
Enable AMSI Full Mode and restrict network access to trusted IPs only. These are temporary mitigations — patching and key rotation remain mandatory.

Q: Why are there three exploited SharePoint RCEs in one month?
SharePoint's complex .NET deserialization surface, widespread internet exposure, and high value as a document repository make it a prime target. The July 2026 Patch Tuesday addressed 17 SharePoint CVEs alone — the largest monthly batch for the product.

Key Takeaways

• CVE-2026-50522 is a CVSS 9.8 deserialization RCE in on-premises SharePoint Server, actively exploited since a public PoC emerged in July 2026.
• CISA added it to the KEV catalog July 22; federal agencies had until July 25 to patch.
• All supported versions (Subscription Edition, 2019, 2016) are affected. SharePoint Online is not.
• Patching is necessary but insufficient — rotate IIS machine keys on all farm servers after updating.
• SharePoint 2016 and 2019 reached end of extended support in July 2026 with no ESU program. Upgrade or migrate immediately.
• This is the third exploited SharePoint RCE in July 2026. Prioritize SharePoint patching in every cycle going forward.
• Deploy detection rules (Suricata, YARA, Sigma) to catch exploitation attempts in logs.

Conclusion

The July 2026 Patch Tuesday was historic — 622 CVEs, the largest Microsoft release on record — but CVE-2026-50522 demands special attention. It combines a maximum-severity score, active exploitation, a public PoC, and a persistence mechanism (machine key theft) that survives patching. For SharePoint administrators, the playbook is clear: patch now, rotate keys, hunt for compromise, and plan your migration off end-of-life versions. The era of "patch next week" ended when the PoC dropped.

---

Sources:

• Microsoft Security Update Guide - CVE-2026-50522
• The Hacker News - Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation
• CISA Adds Two Known Exploited Vulnerabilities to Catalog
• The Hacker News - Microsoft Patches Record 622 Flaws
• WatchTowr LinkedIn - Active Exploitation Alert