CVE-2026-50522 (CVSS 9.8 Critical) is the third actively exploited SharePoint Server vulnerability disclosed in July 2026. This unauthenticated deserialization flaw allows remote code execution on on-premises SharePoint deployments, with attackers already stealing IIS machine keys for persistent access. If you run SharePoint Server Subscription Edition, 2019, or 2016, patch immediately and rotate credentials on any potentially exposed assets.

Vulnerability Details

Metric	Value
CVE ID	CVE-2026-50522
CVSS 3.1 Score	9.8 Critical
Attack Vector	Network (AV:N)
Attack Complexity	Low (AC:L)
Privileges Required	None (PR:N)
User Interaction	None (UI:N)
Scope	Changed (S:C)
CWE	CWE-502: Deserialization of Untrusted Data
Affected Products	SharePoint Server Subscription Edition, 2019, 2016
Patch Release	July 2026 Patch Tuesday (KB 5064942, 5064943, 5064944)
Exploitability Assessment	Exploitation More Likely
CISA KEV Status	Added July 22, 2026

Microsoft credits DEVCORE researcher splitline (@splitline) for discovering and reporting this vulnerability through coordinated disclosure.

Impact Assessment

What Is at Risk

This vulnerability is not a theoretical concern. watchTowr Labs confirmed active exploitation against on-premises SharePoint deployments following the release of a public proof-of-concept exploit. Threat actors are:

1. Executing arbitrary code remotely on SharePoint servers without authentication
2. Stealing IIS machine keys from web.config to forge ViewState payloads and maintain persistent access
3. Deploying web shells (e.g., spinstall0.aspx) for long-term footholds
4. Chaining with other July 2026 SharePoint flaws (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644) for authentication bypass and privilege escalation

Affected Systems

All supported on-premises SharePoint Server versions:

• SharePoint Server Subscription Edition
• SharePoint Server 2019 (Standard and Enterprise)
• SharePoint Server 2016 (Enterprise)

Note: SharePoint Online and Microsoft 365 are not affected : Microsoft manages patching for cloud tenants.

Why This Matters for Developers and Engineers

SharePoint is not just a document library. In enterprise environments, it integrates deeply with:

• Active Directory : farm accounts often have domain-level privileges
• SQL Server : content databases store sensitive business data
• IIS : machine keys protect ViewState, forms authentication, and encryption
• Power Platform / Power Automate : custom workflows execute in SharePoint context

A compromised SharePoint server becomes a trusted gateway for lateral movement. Attackers with machine keys can forge authenticated requests, bypass WAF rules, and pivot to domain controllers and SQL instances.

Root Cause Analysis

The vulnerability resides in SharePoint's handling of serialized .NET objects. When deserializing untrusted data without proper validation (CWE-502), an attacker can craft a malicious object graph that executes arbitrary code during deserialization, granting RCE in the application pool context.

Specifically, the flaw allows an unauthenticated attacker to send a crafted HTTP request to a vulnerable SharePoint endpoint. The server deserializes the payload, instantiating attacker-controlled types that execute code in the SharePoint application pool context (typically a high-privilege service account).

Technical Details

• Attack Vector: Network (AV:N) : exploitable from the internet
• Authentication: None required (PR:N) : unauthenticated exploitation confirmed
• Complexity: Low (AC:L) : reliable exploitation with public PoC
• Impact: Full RCE, credential theft (machine keys), persistence via web shells

Microsoft's advisory states: "In a network-based attack, an attacker authenticated as at least a Site Owner, could write arbitrary code to inject and execute code remotely on the SharePoint Server." However, watchTowr and Defused Cyber observed unauthenticated exploitation in the wild : the captured requests carried no authentication material, matching CVE-2026-50522's unauthenticated profile.

Affected Systems and Versions

Product	Affected Versions	Fixed In
SharePoint Server Subscription Edition	All builds prior to July 2026 CU	July 2026 CU (KB 5064942)
SharePoint Server 2019	All builds prior to July 2026 PU	July 2026 PU (KB 5064943)
SharePoint Server 2016	All builds prior to July 2026 PU	July 2026 PU (KB 5064944)

Check your build version:

Compare against the fixed build numbers in the Microsoft Security Update Guide.

Mitigation and Patching

Immediate Actions

1. Apply July 2026 Security Updates

   • Download from Microsoft Update Catalog or WSUS/SCCM
   • Run SharePoint Products Configuration Wizard after install
   • Verify Get-SPFarm | Select-Object BuildVersion shows patched build

2. Rotate All IIS Machine Keys

   • This is critical and distinct from patching: extracted keys let attackers forge ViewState payloads and bypass authentication on patched servers.
   • Generate new <machineKey> elements in web.config for each SharePoint web app:
     xml
   • Use aspnet_regiis.exe -pc "CustomKeys" -exp or a secure random generator
   • Coordinate rotation across all farm servers simultaneously

3. Audit for Web Shells and Suspicious Files

   • Search for recently created .aspx, .ashx, .asmx files in SharePoint web directories:
     powershell
   • Check for: spinstall0.aspx, shell.aspx, cmd.aspx, upload.aspx

4. Review IIS Logs

   • Look for POST requests to /layouts/..., /_vti_bin/... with Base64 serialized objects
   • Correlate with July 14-22, 2026 timestamps

Workaround (If Immediate Patching Is Impossible)

If you cannot patch in 24 hours:

• Block internet access to SharePoint servers at the firewall
• Restrict access to known corporate IP ranges only
• Enable WAF rules blocking deserialization payloads (ViewState, TypeNameHandling)
• Monitor aggressively for anomalous authentication events and file creation

Warning: Patching alone is insufficient. Machine key rotation is mandatory: compromised keys enable persistent access even on patched servers.

Detection Guidance

Network-Based Detection (Suricata / Zeek)

Host-Based Detection (YARA)

Sigma Rule for SIEM

Frequently Asked Questions

Is SharePoint Online affected?

No. SharePoint Online and Microsoft 365 are managed by Microsoft and are not affected by this on-premises vulnerability.

Does patching remove web shells?

No. Patching prevents future exploitation but does not remove existing web shells or compromised keys. You must manually remove shells and rotate keys.

Can I just block the vulnerable endpoint?

There is no single endpoint to block. The deserialization vulnerability can be triggered through multiple SharePoint entry points. Patching is the only reliable fix.

What if I already applied the July 2026 Patch Tuesday updates?

Verify your build version matches the fixed versions above. If you applied updates on July 14, 2026, you should be protected, but you must still rotate machine keys if the server was internet-exposed before patching.

How do I know if I was compromised?

Look for: unexpected web files in SharePoint directories, anomalous authentication events in Security logs, machine key extraction artifacts in IIS logs, outbound connections from the SharePoint application pool account.

Key Takeaways

• CVE-2026-50522 is a CVSS 9.8 unauthenticated RCE in on-premises SharePoint Server : actively exploited since July 2026
• Three SharePoint CVEs are now on the CISA KEV catalog (CVE-2026-45659, CVE-2026-56164, CVE-2026-58644) with CVE-2026-50522 added July 22
• Patching is necessary but not sufficient : you must rotate IIS machine keys to prevent persistent access via forged ViewState
• Attackers chain multiple SharePoint flaws for authentication bypass, RCE, credential theft, and lateral movement
• Detection requires layered approach: network IDS (Suricata), host scanning (YARA), and SIEM correlation (Sigma)

Conclusion

The July 2026 SharePoint vulnerability cluster shows how a single deserialization flaw cascades into full enterprise compromise with machine key theft and web shell persistence. CVE-2026-50522 CVE-2026-50522's unauthenticated RCE makes it one of the most dangerous SharePoint vulnerabilities recently.

Organizations running on-premises SharePoint must treat this as a maximum priority incident: patch immediately, rotate all machine keys, hunt for web shells, assume compromise if internet-exposed before July 14. The remediation window has closed for unpatched systems: act now.

---

Sources

• Microsoft Security Update Guide: CVE-2026-50522
• The Hacker News: Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation
• Resecurity: From Web Request to Domain Compromise
• CISA Known Exploited Vulnerabilities Catalog
• BleepingComputer: CISA Microsoft SharePoint RCE Flaw Now Actively Exploited