CVE-2026-50522: Microsoft SharePoint Unauthenticated RCE (CVSS 9.8) Exploited After Public PoC — Patch Now

A critical unauthenticated remote code execution vulnerability in Microsoft SharePoint Server has been actively exploited in the wild after a public proof-of-concept was released. CVE-2026-50522 carries a CVSS v3.1 base score of 9.8 — the highest common severity rating — and affects every supported on-premises SharePoint Server version. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on July 22, 2026, setting a federal agency patch deadline of July 25. If your organisation has not yet applied the July 2026 Patch Tuesday updates to SharePoint, this post is your remediation briefing.

Vulnerability Summary

CVE-2026-50522 is a deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint Server. An unauthenticated attacker with network access to the target server can send a crafted .NET deserialization payload to a SharePoint sign-in endpoint and achieve arbitrary code execution in the context of the SharePoint application pool — with no authentication, no privileges, and no user interaction required.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the worst-case scenario: it is network-accessible, low complexity, and has high impact across confidentiality, integrity, and availability. This is as bad as an unauthenticated pre-auth RCE gets.

Affected Versions

The following on-premises SharePoint Server versions are vulnerable:

• SharePoint Enterprise Server 2016: versions prior to 16.0.5561.1001
• SharePoint Server 2019: versions prior to 16.0.10417.20175
• SharePoint Server Subscription Edition: versions prior to 16.0.19725.20434

Microsoft 365 SharePoint Online is not affected. If your organisation runs SharePoint exclusively through Microsoft 365, you are not exposed to this specific vulnerability.

How Attackers Are Exploiting It

Within hours of a public proof-of-concept being published, threat actors began weaponising CVE-2026-50522 at scale. Captured exploitation attempts show attackers delivering malicious .NET serialized objects to the SharePoint sign-in endpoint — specifically targeting the WebResource.axd and ScriptResource.axd handlers that process ViewState data without adequate validation.

Post-exploitation activity is consistent with what we have seen in previous SharePoint exploitation campaigns: attackers are harvesting IIS machine keys from the target server. These keys are used to forge FormsAuthentication tokens and maintain persistent, authenticated access to the SharePoint environment even after the initial vulnerability is patched. Organisations that patch the RCE but fail to rotate their machine keys remain exposed to follow-on attacks leveraging stolen keys.

The attack chain does not require any prior knowledge of the target environment, no valid credentials, and no interaction from any SharePoint user. Any internet-facing SharePoint instance running a vulnerable version is a target.

Why This Matters Beyond the SharePoint Server

SharePoint is not just a document management system. In most enterprise environments, it is deeply integrated with Active Directory, Exchange, and in many cases with enterprise authentication infrastructure via AD FS. A compromised SharePoint server frequently provides an attacker with a foothold from which to pivot to broader network resources, harvest credentials from integrated systems, and move laterally with high-privilege tokens.

The ongoing exploitation of SharePoint has been a theme throughout 2026 — CVE-2026-45659, CVE-2026-58644, and CVE-2026-56164 have all been added to CISA KEV this year. Nation-state actors and ransomware groups have both demonstrated persistent interest in SharePoint as an initial access vector. CVE-2026-50522 is the latest in this pattern, and the presence of a public PoC means the barrier to exploitation is trivially low.

Immediate Remediation Steps

Apply the July 2026 Patch Tuesday cumulative updates for your specific SharePoint version as the highest priority. The patched build numbers are listed above. Microsoft released these updates on July 14, 2026.

After applying the patch, take the following additional steps:

Rotate IIS Machine Keys: If your SharePoint server was internet-facing and running a vulnerable version between the time of PoC publication and your patch application, assume machine keys may have been extracted. Generate new machine keys in IIS Manager for all SharePoint web applications and update them consistently across your farm.

Review SharePoint Logs: Check IIS logs for unusual POST requests to WebResource.axd, ScriptResource.axd, or the SignIn.aspx endpoint from unexpected source IPs. Look for large, unusual payloads sent to these endpoints. Any such traffic should be treated as a potential compromise indicator and escalated to incident response.

Enable Microsoft Defender for Endpoint Detections: Microsoft has published AMSI detection signatures for CVE-2026-50522 exploitation attempts. Ensure Defender for Endpoint is deployed on SharePoint servers with real-time protection enabled and AMSI integration active.

Network Segmentation: If operational constraints prevent immediate patching, restrict network access to SharePoint Server so that only known, authorised IP ranges can reach the web application. This is a workaround, not a fix — patch as soon as operationally possible.

Audit Service Accounts: Post-exploitation actors frequently abuse SharePoint service accounts that have broad Active Directory permissions. Audit the permissions of any service accounts used by SharePoint and apply least-privilege principles.

For Organisations Already Patched

If you applied July 2026 Patch Tuesday updates when they were released on July 14, you are protected against CVE-2026-50522. However, the machine key rotation advice stands regardless of your patch status — prior SharePoint vulnerabilities from earlier in 2026 may have already enabled key theft on vulnerable systems that were subsequently patched without key rotation.

How Alastor InfoSec Helps

Determining whether your SharePoint environment was compromised during the exploitation window requires more than checking patch levels. Our team at Alastor Pulse conducts SharePoint-specific compromise assessments covering patch state validation, log forensics for exploitation indicators, machine key exposure analysis, and AD lateral movement pathways. Enforster AI continuously monitors your external attack surface for exposed SharePoint instances running vulnerable versions.

Contact us at [email protected] to arrange an emergency SharePoint compromise assessment or to discuss continuous monitoring coverage for your environment.

CVE-2026-50522 is textbook pre-auth RCE with a public exploit — patch immediately, rotate machine keys, and treat any internet-facing SharePoint server that ran a vulnerable version as potentially compromised until forensically cleared.