CVE-2026-50522 PoC Fuels SharePoint Attacks

Attackers are exploiting CVE-2026-50522, a critical Microsoft SharePoint Server vulnerability, after public proof-of-concept (PoC) exploit code became available. The activity targets on-premises SharePoint deployments and raises a serious post-compromise concern: attackers are reportedly stealing machine keys that can help them retain access even after patching.

Microsoft addressed CVE-2026-50522 in its July 2026 Patch Tuesday security updates. At release, the flaw was not marked as actively exploited, but Microsoft presented it with a critical severity and an exploitability profile that made it a high-priority SharePoint issue.

What Is CVE-2026-50522?

CVE-2026-50522 (CVSS 9.8) is a deserialization of untrusted data vulnerability in Microsoft Office SharePoint. NVD describes the issue as allowing an unauthorized attacker to execute code over a network.

The flaw is tracked as CWE-502, a vulnerability class that can become especially dangerous when an application processes attacker-controlled serialized data. In SharePoint’s case, successful exploitation can lead to Remote Code Execution on the affected server.

Which SharePoint Versions Are Affected by CVE-2026-50522?

The vulnerability affects supported on-premises SharePoint Server versions, including:

Microsoft’s July 14 update for SharePoint Server Subscription Edition lists CVE-2026-50522 among the vulnerabilities addressed by the security release.

Why Did Exploitation Escalate After the PoC?

The key shift was the release of public exploit code. According to watchTowr, proof-of-concept exploit code for CVE-2026-50522 appeared on July 20, and exploitation attempts were captured within hours across its honeypot network. The company said the observed attacks targeted on-premises SharePoint deployments and attempted to steal machine keys for long-term access.

This timeline highlights the brief window between public exploit availability and active attacks, showing how quickly vulnerable internet-facing SharePoint servers are exposed.

How Does the Public PoC for CVE-2026-50522 Work?

Publicly available PoC details, published by researcher Janggggg, describe a deserialization attack path involving SharePoint’s sign-in flow. The PoC attempts to deliver a malicious .NET BinaryFormatter payload through a forged security token submitted to the /_trust/default.aspx endpoint.

If a vulnerable server processes the crafted token through the affected deserialization path, the result can be arbitrary code execution on the SharePoint server.

Defenders should avoid focusing only on one exact PoC pattern. Defused reported an undocumented SharePoint deserialization vector in honeypot traffic before later assessing that the activity was likely tied to CVE-2026-50522.

Why Are SharePoint Machine Keys Important?

Machine keys are used by ASP.NET applications for cryptographic operations, including validation and protection of authentication-related data. If attackers obtain SharePoint machine keys, they may be able to forge valid authentication tokens and impersonate users.

That is why this vulnerability is not only a patching problem. A server that was exposed before patching may still carry risk if attackers already obtained keys, tokens, credentials, or other sensitive material.

In practical terms, patching closes the known vulnerability path, but it does not automatically invalidate stolen machine keys or remove post-exploitation artifacts.

How Does This Fit Into the July SharePoint Attack Wave?

CVE-2026-50522 is part of a broader July 2026 SharePoint risk picture. Cybersecurity and Infrastructure Security Agency (CISA) has warned about active exploitation of multiple SharePoint Server vulnerabilities, and CVE-2026-58644, another SharePoint deserialization issue, was added to the Known Exploited Vulnerabilities catalog with a July 19, 2026 remediation due date.SOCRadar’s earlier July 2026 Patch Tuesday coverage already highlighted SharePoint as a priority area, including CVE-2026-50522 and other critical Microsoft fixes. For the full Patch Tuesday breakdown, impacted products, and prioritization context, review SOCRadar’s July 2026 Patch Tuesday analysis.

How Can SOCRadar Help Prioritize SharePoint Response?

SOCRadar’s Cyber Threat Intelligence helps teams track exploit availability, active exploitation claims, threat actor interest, and new technical indicators around vulnerabilities such as CVE-2026-50522. This context helps security teams understand when a patched CVE has turned into an active incident response priority.

SOCRadar’s Attack Surface Management (ASM) adds exposure context by identifying internet-facing SharePoint assets and related infrastructure that may require immediate validation. Combined, these capabilities help teams focus SharePoint remediation where exposure and exploitation signals align.

What Should Security Teams Do Now?

Security teams running on-premises SharePoint should treat CVE-2026-50522 as urgent, especially where servers are internet-facing or exposed to broad internal access.

Recommended actions include:

• Apply Microsoft’s July SharePoint updates: Confirm patch levels across all SharePoint farms, including staging, disaster recovery, and legacy environments.
• Rotate machine keys after investigation: First hunt for intrusion artifacts and key-harvesting activity, then rotate exposed machine keys to prevent continued abuse.
• Review authentication activity: Look for forged or unusual tokens, unexpected sign-in behavior, and suspicious requests to /_trust/default.aspx.
• Check for post-exploitation artifacts: Review web server logs, new files, unexpected child processes, suspicious PowerShell activity, and outbound connections from SharePoint servers.
• Validate privileges and persistence: Review new admin accounts, altered permissions, modified web.config files, scheduled tasks, and unexpected service changes.

Exposed SharePoint servers need full validation after patching, especially where exploitation may have occurred before updates were applied. Machine key rotation, authentication review, and persistence checks should all be part of the remediation process.