Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC
A critical SharePoint vulnerability (CVE-2026-50522) is currently being actively exploited, allowing attackers to execute code remotely and steal machine keys. Microsoft released a patch last month, but attackers are leveraging a public proof-of-concept to gain persistent access and deploy malware. Multiple vulnerabilities within SharePoint Server are being targeted, highlighting a significant ongoing risk for organizations using on-premises deployments.
A critical SharePoint Server flaw, CVE-2026-50522 (CVSS score: 9.8), is currently under active exploitation, according to watchTowr. The vulnerability involves the deserialization of untrusted data within Microsoft Office SharePoint, enabling an attacker to execute code over a network. Microsoft credited DEVCORE researcher "splitline" with discovering and reporting the flaw.
"In a network-based attack, an attacker authenticated as at least a Site Owner, could write arbitrary code to inject and execute code remotely on the SharePoint Server," Redmond said in an advisory released last week. The attack vector is Network (AV:N) because this vulnerability is remotely exploitable and can be exploited from the internet. The attack complexity is Low (AC:L) because an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component.
Microsoft tagged CVE-2026-50522 with an exploitability assessment of "Exploitation More Likely." WatchTowr has detected active exploitation of the shortcoming against on-premises Microsoft SharePoint deployments following the release of a public proof-of-concept (PoC) exploit, allowing attackers to steal machine keys to maintain persistent access.
"Attackers are pulling SharePoint machine keys via a single request," the security vendor said. Patching is not enough; defenders should rotate credentials on any assets that may have been exposed.
CVE-2026-50522 is the third vulnerability in SharePoint Server after CVE-2026-56164 (CVSS score: 5.3) and CVE-2026-58644 (CVSS score: 9.8) to witness active exploitation efforts, with the latter two weaponized as zero-days prior to them being fixed in July 2026. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has since warned that threat actors are exploiting multiple SharePoint Server vulnerabilities, including CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644, to gain unauthorized access to on-premises instances. "These vulnerabilities affect all supported on-premises SharePoint Server versions (Subscription Edition, 2019, and 2016) and involve establishing remote code execution (RCE) and post-exploitation activities, such as stealing Internet Information Services (IIS) machine keys and performing deserialization techniques, to gain persistence and deploy malware," the agency said.