SharePoint CVE-2026-50522: Critical RCE Under Active Exploitation to Steal Machine Keys

Microsoft SharePoint administrators are racing to patch a critical remote code execution vulnerability that attackers are actively exploiting in the wild. The flaw, tracked as CVE-2026-50522, allows unauthenticated remote code execution through a deserialization weakness. Moreover, threat actors are stealing machine keys during exploitation to maintain persistent access even after servers are patched.

What Happened: CVE-2026-50522 Exploitation Begins Within Hours of PoC Release

Microsoft disclosed CVE-2026-50522 as part of its July 2026 Patch Tuesday security updates. The company classified the vulnerability as a deserialization of untrusted data flaw that enables remote code execution over a network without requiring authentication. Consequently, any internet-facing SharePoint server that remains unpatched is at significant risk.

Although Microsoft did not initially mark the vulnerability as actively exploited, its advisory noted an increased likelihood of exploitation. Therefore, defenders should have treated it as a high-priority patch. Unfortunately, the window between disclosure and active exploitation was extremely narrow.

On July 20, 2026, security researcher Janggggg published a proof-of-concept exploit on GitHub. Within hours, offensive security firm watchTowr detected exploitation attempts through its global honeypot network. In other words, attackers began weaponizing the flaw almost immediately after the PoC became public.

Furthermore, early warning threat intelligence company DefusedCyber observed an undocumented SharePoint deserialization vector in attacks as early as July 17, 2026. The company later linked this activity to CVE-2026-50522 exploitation. Thus, some threat actors may have had access to the exploit before the public release.

Technical Details of the SharePoint RCE Vulnerability

CVE-2026-50522 stems from insecure deserialization within SharePoint’s authentication pipeline. An attacker can craft a malicious WS-Federation sign-in response containing a forged SecurityContextToken cookie. When SharePoint processes this token, it deserializes an embedded .NET BinaryFormatter payload. As a result, arbitrary code executes on the server with the permissions of the SharePoint application pool.

The published proof-of-concept demonstrates this attack chain in PowerShell. It delivers a malicious payload through the /_trust/default.aspx endpoint. BleepingComputer did not independently test the exploit, but the code appears structurally and technically legitimate. The exploit requires no prior authentication, which makes it especially dangerous for exposed SharePoint instances.

However, the most concerning aspect of the observed attacks is not the initial code execution. Attackers are specifically targeting and extracting machine keys from compromised servers. These cryptographic keys allow an attacker to forge valid authentication tokens for any user on the system. Therefore, even after administrators apply the July patch, a stolen machine key enables persistent impersonation and unauthorized access to SharePoint sites and documents.

Attack Chain Overview

1. The attacker sends a crafted WS-Federation sign-in request to the vulnerable SharePoint server.
2. SharePoint deserializes the malicious SecurityContextToken cookie, triggering remote code execution.
3. The attacker extracts machine keys from the compromised server.
4. Using the stolen keys, the attacker forges authentication tokens to impersonate users indefinitely.
5. The attacker maintains access even after the SharePoint patch is applied.

Business and Operational Impact

SharePoint serves as a primary document management and collaboration platform for thousands of enterprises worldwide. Consequently, a successful exploit can expose sensitive corporate data, intellectual property, customer records, and internal communications. The impact extends beyond the initial breach because machine key theft creates a long-term persistence mechanism.

The following categories summarize the key risks:

• Data exposure: Attackers can access confidential documents, financial records, and strategic plans stored in SharePoint libraries.
• Identity impersonation: Forged authentication tokens allow attackers to operate as legitimate users, making detection extremely difficult.
• Compliance violations: Unauthorized access to regulated data may trigger GDPR, HIPAA, or SOX reporting obligations.
• Business disruption: Incident response, credential rotation, and forensic investigations consume significant resources and time.
• Lateral movement: A compromised SharePoint server often sits within the corporate network, providing a foothold for broader attacks.

Moreover, organizations that rely on cloud-hosted SharePoint Online are not affected by this specific flaw. The vulnerability targets on-premise SharePoint deployments, which are common in regulated industries and organizations with strict data residency requirements.

Mitigation and Recommendations

Immediate action is essential for any organization running on-premise SharePoint. The following steps provide a prioritized response plan.

Immediate Actions for Defenders

1. Apply the July 2026 Patch Tuesday updates immediately. Microsoft has released patches that remove the vulnerable deserialization path.
2. Rotate machine keys on all potentially exposed SharePoint servers. This is critical because stolen keys bypass the patch entirely.
3. Review authentication logs for suspicious WS-Federation requests to /_trust/default.aspx. Look for unusual sign-in attempts around July 17 through July 21, 2026.
4. Audit SharePoint administrative accounts and document access logs. Check for unexpected privilege escalations or document downloads.
5. Restrict network access to SharePoint administrative endpoints. Limit exposure to trusted IP ranges wherever possible.

Long-Term Hardening

Beyond the immediate response, organizations should strengthen their SharePoint security posture to reduce future risk. For example, enabling multi-factor authentication for all administrative accounts adds a layer of protection even if tokens are compromised. Additionally, implementing network segmentation can limit lateral movement if a SharePoint server is breached.

Furthermore, security teams should review their vulnerability management process. The rapid weaponization of CVE-2026-50522 demonstrates that proof-of-concept exploits now appear within hours of disclosure. Therefore, organizations must compress their patch deployment timelines for critical vulnerabilities. Automated patch management and emergency patching procedures can make the difference between safety and compromise.

Bottom line: Patch SharePoint immediately, rotate machine keys, and hunt for signs of compromise. A patch alone is not enough if attackers have already stolen your machine keys.

Incident Summary

CVE ID / Incident:	CVE-2026-50522
Affected Systems:	Microsoft SharePoint on-premise deployments
Disclosure Date:	July 14, 2026 (Microsoft Patch Tuesday)
Exploitation Start:	July 17, 2026 (early signs); July 20, 2026 (public PoC, mass exploitation)
Patch Status:	Available via July 2026 Patch Tuesday
Severity:	Critical — unauthenticated RCE with persistent machine key theft

References

1. Microsoft Security Response Center, “CVE-2026-50522,” Microsoft Update Guide, July 14, 2026, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522, accessed July 22, 2026.
2. BleepingComputer, “Critical SharePoint RCE flaw exploited to steal machine keys,” July 21, 2026, https://www.bleepingcomputer.com/news/security/critical-sharepoint-rce-flaw-exploited-to-steal-machine-keys/, accessed July 22, 2026.
3. watchTowr, LinkedIn post on CVE-2026-50522 exploitation observations, July 20, 2026, https://www.linkedin.com/feed/update/urn:li:activity:7485278595850940416/, accessed July 22, 2026.
4. DefusedCyber, Twitter/X posts on SharePoint deserialization exploitation, July 17 and July 21, 2026, https://x.com/DefusedCyber, accessed July 22, 2026.
5. Janggggg, GitHub proof-of-concept for CVE-2026-50522, July 20, 2026, https://x.com/testanull/status/2079082982640668990, accessed July 22, 2026.