Summary

Public reports of active exploitation of CVE-2026-50522 have been published, highlighting a critical Microsoft SharePoint Server vulnerability (CVSS 9.8) affecting on-premises deployments. The flaw is caused by insecure deserialization and can enable remote code execution (RCE), allowing attackers to compromise vulnerable SharePoint environments. According to public reporting, exploitation activity increased following the release of a publicly available proof-of-concept (PoC) exploit, with attackers leveraging the vulnerability to extract SharePoint machine keys, establish persistence, and conduct additional post-compromise activities.

The threat is considered significant due to the widespread use of SharePoint and the low complexity required for successful exploitation. Supported on-premises SharePoint Server versions, including Subscription Edition, SharePoint 2019, and SharePoint 2016, may be impacted if not fully patched. Organizations should assume that internet-exposed systems may be targeted opportunistically and should prioritize patching, credential and machine key rotation, and forensic review of potentially affected servers. CISA has added CVE-2026-50522 to its Known Exploited Vulnerabilities (KEV) catalog, underscoring the urgency of remediation efforts.

Affected Systems and/or Applications

• Microsoft SharePoint Server 2016 (Patched in build 16.0.5561.1001)
• Microsoft SharePoint Server 2019 (Patched in build 16.0.10417.20175)
• Microsoft SharePoint Server Subscription Edition (SE) (Patched in build 16.0.19725.20434)

Note: SharePoint Server 2016 and 2019 have reached end-of-life (EOL) status, increasing their vulnerability to exploitation.

Technical Details

CVE-2026-50522 arises from the claims-based authentication flow in SharePoint, specifically the endpoint /_trust/default.aspx, which is accessible to unauthenticated users. Exploitation involves sending a crafted HTTP POST request with a serialized payload to this endpoint, leading to arbitrary command execution in the context of IIS worker processes (w3wp.exe). The vulnerability is exacerbated by the use of the unsafe BinaryFormatter method for deserialization.

Threat actors have been observed deploying malicious .NET assemblies and web shells, exfiltrating system information, and attempting to extract machine keys. The exploitation has affected over 25 organizations across various industries, including government, financial services, academia, and more.

Mitigation

1. Apply Patches: Immediately apply the patches released by Microsoft on July 14, 2026, for CVE-2026-50522.
2. Restrict Access: Limit network access to the /_trust/default.aspx endpoint to trusted identity provider IP addresses.
3. Monitor Indicators: Watch for abnormal HTTP requests to /_trust/default.aspx and reflective .NET assembly loading in w3wp.exe.
4. Rotate Keys: If compromise is detected, consider rotating SharePoint machine keys as a precaution.
5. Conduct Threat Hunting: Examine IIS worker processes for suspicious in-memory assembly loads. Consider dumping or scanning the w3wp.exe process's memory for further analysis.

What the Cyber Fusion Center is Doing

The CFC is monitoring the situation and preparing a threat-hunting campaign. This advisory will be updated if required.

References

• Microsoft Security Response Center: CVE-2026-50522
• The hacker News Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC
• Microsoft Lifecycle Products: SharePoint Server 2019, SharePoint Server 2016
• GitHub: ysoserial.net Project This advisory underscores the critical need for immediate action to mitigate the risks associated with CVE-2026-50522, particularly for organizations relying on EOL SharePoint versions.
• CWE Common Weakness Enumeration: CWE-502: Deserialization of Untrusted Data

‍