Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation

Microsoft has confirmed that a third SharePoint Server vulnerability fixed in its July 2026 Patch Tuesday cycle is now being actively exploited in the wild. Tracked as CVE-2026-50522, the flaw carries a maximum severity rating and allows a remote, unauthenticated attacker to execute code on vulnerable on-premises SharePoint servers. Researchers at watchTowr observed exploitation shortly after a public proof-of-concept (PoC) was released, raising the urgency for administrators who have not yet deployed the cumulative update.

The vulnerability sits inside SharePoint's handling of untrusted serialized data. Because deserialization bugs typically accept attacker-controlled payloads without sufficient validation, exploitation can be as simple as sending a crafted request to an exposed SharePoint endpoint. For organizations running SharePoint Server 2016, 2019, or Subscription Edition on their own infrastructure, the practical impact is a pre-authentication remote code execution pathway into a system that often holds sensitive documents, internal apps, and integration credentials. The good news is that a fix already exists; the bad news is that public tooling makes mass scanning trivial.

Key Takeaways

• CVE-2026-50522 is a critical SharePoint Server deserialization vulnerability with a CVSS score of 9.8 and a public PoC.
• Active exploitation has been observed by watchTowr shortly after the PoC release, making unpatched servers a live target.
• The bug affects on-premises SharePoint Server deployments, not SharePoint Online in Microsoft 365.
• Microsoft credited researcher DEVCORE for reporting the flaw as part of its July 2026 Patch Tuesday update.
• Administrators should patch immediately, review logs for indicators of compromise, and restrict internet exposure of SharePoint admin and content endpoints.

What CVE-2026-50522 Actually Does

CVE-2026-50522 is classified as a deserialization of untrusted data vulnerability inside Microsoft Office SharePoint Server. Deserialization flaws become dangerous when an application reconstructs objects from attacker-supplied data without strictly validating types, fields, or contained classes. A crafted payload can trigger arbitrary code execution during the reconstruction phase, often before the request is fully authenticated.

Because the vulnerable component processes incoming network traffic on standard SharePoint web ports, an attacker does not need valid credentials or a valid user account. In practical terms, any internet-exposed SharePoint front-end server becomes a candidate target. Once code execution is achieved, the attacker typically lands inside the SharePoint application pool context, which on many deployments has access to internal databases, service accounts, and integrated business systems. From that foothold, lateral movement into file shares, mail servers, or domain controllers is a common next step.

Microsoft credited DEVCORE with reporting this flaw, the same research team credited with several other notable SharePoint disclosures in recent years. The credit matters because it suggests the finding came through coordinated disclosure rather than a leaked zero-day, meaning defenders had a window to patch before public tooling appeared.

Why Public PoC Changes the Risk Picture

Disclosure of a critical vulnerability is serious, but the release of a working public proof-of-concept is what typically shifts risk from theoretical to operational. Once a PoC is published, opportunistic attackers, ransomware affiliates, and botnet operators can copy, adapt, and weaponize the exploit within hours. Automated scanners begin probing for vulnerable endpoints almost immediately.

watchTowr reported active exploitation after the PoC appeared, which is consistent with the pattern seen in prior SharePoint deserialization issues. The exploitation does not require sophisticated tradecraft: a single HTTP request can be enough to demonstrate the issue, and tuned variants can deliver web shells, persistence mechanisms, or credential harvesting tools. Defenders should therefore treat any unpatched, internet-facing SharePoint deployment as compromised until proven otherwise.

How CVE-2026-50522 Compares to Other Recent SharePoint Flaws

Microsoft patched several SharePoint issues in July 2026. CVE-2026-50522 is described as the third SharePoint Server flaw addressed in that release cycle and the one that has now drawn live attacker attention. The table below summarizes the practical distinctions that matter for administrators weighing response priorities.

Who Is at Risk and What to Check First

This vulnerability affects on-premises Microsoft SharePoint Server installations. It does not affect SharePoint Online tenants within Microsoft 365, since Microsoft manages those servers and patches them centrally. If your organization runs SharePoint Server 2016, 2019, or Subscription Edition, you need to act now.

Start with a quick exposure inventory. Identify every SharePoint farm reachable from the internet, including secondary sites, project workspaces, and partner extranets that may be hosted on the same web application. Confirm the installed patch level against the July 2026 cumulative update published by Microsoft. Any farm that has not absorbed the relevant fix should be treated as exposed, regardless of whether you have seen alerts.

Even if your SharePoint servers sit behind a VPN or reverse proxy, an attacker who has already established a foothold inside your network can still reach them. Internal reconnaissance followed by SharePoint exploitation is a common pattern in ransomware intrusions, so the patch matters even for non-internet-facing farms. Protecting those servers with strong perimeter and identity controls remains essential, and solutions such as Free DDoS Protection and Advanced DDoS Protection can help reduce the broader attack surface against web-facing workloads.

Immediate Response Checklist for Administrators

Given the severity and the presence of active exploitation, a structured response is more reliable than ad-hoc steps. The checklist below covers the actions most likely to reduce risk within the next 24 to 72 hours.

• Apply the Microsoft July 2026 SharePoint cumulative update that addresses CVE-2026-50522 to every affected farm, starting with internet-exposed front ends.
• Restart SharePoint application pools and relevant SharePoint services as required by the patch documentation so the new binaries are loaded.
• Review IIS logs, SharePoint diagnostic logs, and any WAF or reverse proxy logs for unusual POST requests, suspicious serialized payloads, or spikes in 500-class errors against SharePoint endpoints.
• Hunt for web shells in the SharePoint web root, _layouts, _vti_bin, and any custom hive directories where attackers commonly drop persistent code.
• Audit SharePoint service accounts, farm accounts, and any cached credentials for unexpected use, privilege changes, or logons from unusual sources.
• Restrict SharePoint admin centers, central administration sites, and management ports to privileged networks wherever operationally possible.
• Confirm backups of SharePoint content databases and web applications are current, offline, and tested for restore.

Hardening SharePoint Beyond This Patch

Patching closes the specific code path abused by CVE-2026-50522, but SharePoint's broader attack surface warrants continued attention. A few defensive practices significantly reduce the blast radius of the next inevitable SharePoint disclosure.

Front-end servers should sit behind a reverse proxy or WAF that performs protocol validation and rate limiting. Where possible, SharePoint content sites should be reachable only through authenticated sessions, with anonymous access disabled unless explicitly required. Certificate hygiene matters too, and tying internal admin paths to free SSL certificates issued by trusted authorities prevents downgrade or interception attacks that often precede exploitation.

Operational discipline also helps. Keeping a tested patch cadence, subscribing to Microsoft security advisories, and rehearsing an emergency change window for out-of-band updates are all small investments that pay off during events like this one. For organizations that want stronger baseline infrastructure around SharePoint workloads, pairing on-premises SharePoint with hardened hosting tiers such as Managed Cloud VPS Hosting can isolate SharePoint from unrelated web apps and limit lateral movement opportunities. And if a compromise is suspected, professional incident response and Malware Removal and Security support can shorten the time from detection to recovery.

Frequently Asked Questions

What is CVE-2026-50522?

CVE-2026-50522 is a critical deserialization of untrusted data vulnerability in Microsoft Office SharePoint Server that allows an unauthenticated remote attacker to execute code over the network. It received a CVSS score of 9.8 and was fixed as part of Microsoft's July 2026 Patch Tuesday updates.

Is SharePoint Online in Microsoft 365 affected by CVE-2026-50522?

No. The vulnerability affects on-premises SharePoint Server deployments such as SharePoint Server 2016, 2019, and Subscription Edition. Microsoft 365 SharePoint Online is managed and patched by Microsoft, and tenants running only the cloud service are not directly impacted by this flaw.

Has CVE-2026-50522 been exploited in the wild?

Yes. Researchers at watchTowr observed active exploitation shortly after a public proof-of-concept was released. Because a working PoC lowers the technical bar for attackers, any unpatched, internet-exposed SharePoint server should be considered a live target.

How quickly do I need to patch CVE-2026-50522?

Immediately. With public tooling available and exploitation already observed, the window of safe operation for unpatched servers is effectively closed. Treat patching as an emergency change, especially for any SharePoint farm reachable from the internet or accessible to users on untrusted networks.

What should I do if I cannot patch right away?

If patching must wait, reduce exposure by placing SharePoint front ends behind a VPN or restricted reverse proxy, blocking direct internet access to management and admin endpoints, enabling aggressive WAF rules for known SharePoint exploitation patterns, and increasing monitoring for suspicious requests and unexpected web files. Even with these mitigations, patching remains the only definitive fix.

Conclusion

CVE-2026-50522 is a textbook example of why SharePoint Server remains a high-value target. The combination of a critical deserialization bug, a public PoC, and confirmed in-the-wild exploitation leaves no room for delay. Administrators should patch affected farms immediately, hunt for signs of compromise, and tighten the network exposure of SharePoint administrative and content endpoints.

Beyond this incident, the same playbook applies to every future SharePoint disclosure: maintain a tested patch process, segment SharePoint from less-trusted workloads, monitor the application layer closely, and keep incident response contacts ready. SharePoint will continue to be attacked precisely because it stores the documents and workflows that organizations depend on. Treating it as critical infrastructure, and protecting it accordingly, is the only durable response.