Critical RCE Vulnerability in Microsoft SharePoint Server: CVE-2026-50522

A new critical security threat has emerged for organizations relying on on-premises Microsoft SharePoint infrastructure. Identified as CVE-2026-50522, this remote code execution (RCE) vulnerability carries a near-maximum CVSS score of 9.8. The flaw is particularly dangerous because it allows unauthenticated, remote attackers to execute arbitrary code with the privileges of the SharePoint service account, potentially leading to a full compromise of the application and the underlying server environment.

The vulnerability was added to the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog on July 22, 2026, confirming that threat actors are actively leveraging this flaw in the wild. This disclosure aligns with recent trends where attackers target enterprise collaboration platforms to facilitate lateral movement and data exfiltration.

Technical Details and Root Cause

The root cause of CVE-2026-50522 lies in the deserialization of untrusted data (classified as CWE-502). The flaw exists within the SessionSecurityTokenHandler class, a component of the Windows Identity Foundation (WIF) framework used by SharePoint. When SharePoint processes a specifically crafted, serialized object from a remote user, it fails to properly validate the contents before restoring the object into memory.

By supplying a malicious payload, an attacker can trick the server into executing code buried within the serialized stream. Because this process occurs during the initial authentication and session handling phase, the attacker does not need to possess any valid credentials to trigger the exploit. This “pre-auth” nature of the attack significantly elevates the risk to any internet-facing SharePoint instance.

Affected Systems

The following on-premises versions of Microsoft SharePoint Server are confirmed to be vulnerable:

• SharePoint Server Subscription Edition (SE)
• SharePoint Server 2019
• SharePoint Server 2016 Enterprise

While Microsoft 365 (SharePoint Online) is generally managed by Microsoft and has inherited protections, the on-premises installations require manual intervention and immediate patching to remain secure.

Impact and Active Exploitation

Security researchers and CISA have observed active exploitation of CVE-2026-50522 following the release of public proof-of-concept (PoC) code. The impact of a successful attack is severe and immediate:

• Remote Code Execution (RCE): The attacker can run commands directly on the server, allowing for the installation of web shells for persistent access.
• Credential and Machine Key Theft: Attackers have been observed using the exploit to steal SharePoint machine keys (ValidationKey and DecryptionKey). Once these keys are stolen, an attacker can forge their own SharePoint cookies and maintain access even after the server is patched.
• Lateral Movement: A compromised SharePoint server often serves as a pivot point for attackers to move into connected Active Directory or Microsoft 365 environments, enabling larger-scale ransomware attacks or corporate espionage.
• Data Exfiltration: Attackers gain direct access to SharePoint content databases, which often house sensitive internal documents, financial records, and PII.

Mitigation and Defensive Actions

To defend against this actively exploited threat, organizations must take the following steps immediately:

1. Apply Security Updates

Install the Microsoft July 2026 security updates for your specific version of SharePoint. Ensure your build number matches or exceeds the versions released this month (e.g., 16.0.19725.20434 for Subscription Edition). Applying the patch closes the deserialization loophole and prevents the initial entry point.

2. Rotate Machine Keys (Crucial)

Simply patching is not enough if your server has already been touched by an attacker. Because threat actors can steal machine keys during the exploitation process, you must rotate your SharePoint machine keys after applying the patch. Failing to do so allows attackers to use previously stolen keys to maintain administrative access through forged session tokens.

3. Restrict Network Exposure

Review the internet visibility of your SharePoint front-end servers. Whenever possible, move these applications behind a secure VPN or an authenticating reverse proxy (like Azure AD Application Proxy). Use firewall rules to strictly limit inbound traffic to your SharePoint management interfaces.

4. Enable Advanced Monitoring

Monitor your servers for unusual child processes originating from the w3wp.exe (IIS worker process). Specifically, look for the spawning of cmd.exe, powershell.exe, or attempts to write files to SharePoint web directories. Inspect your Internet Information Services (IIS) logs for HTTP POST requests containing suspicious base64-encoded strings, which may indicate a deserialization attack attempt.

With threat actors actively scanning for vulnerable instances, there is no time to delay. Administrators should prioritize these updates in their next maintenance window or consider emergency remediation for exposed assets.