CVE-2026-50522 SharePoint RCE: Patching Isn’t Enough
CVE-2026-50522 SharePoint RCE is now the third actively exploited remote code execution flaw hitting Microsoft’s on-premises collaboration platform in three weeks — and this one lets attackers steal cryptographic machine keys that remain valid long after the server is patched. If you run SharePoint Server 2016, 2019, or Subscription Edition on-premises, patching is no longer the finish line.
What Happened
CVE-2026-50522 SharePoint RCE (CVSS 9.8) is a deserialization-of-untrusted-data vulnerability in on-premises Microsoft SharePoint Server, disclosed as part of Microsoft’s record 622-CVE July 2026 Patch Tuesday on July 14. It affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. An unauthenticated attacker who sends a single crafted serialized payload to a vulnerable server can trigger remote code execution — no credentials, no user interaction required.
The flaw sat mostly quiet for six days. On July 20, a public proof-of-concept exploit surfaced, and offensive security firm watchTowr’s global honeypot network recorded successful exploitation attempts within hours. Attackers are using the exploit to extract SharePoint’s ASP.NET machine keys — the ValidationKey and DecryptionKey values SharePoint uses to sign and encrypt authentication tokens — with a single HTTP request. Once an attacker holds those keys, they can forge valid authentication tokens for any user and access SharePoint sites and documents with that user’s privileges, entirely independent of the original vulnerability.
This is the third SharePoint Server RCE with confirmed active exploitation inside three weeks: CVE-2026-56164 (CVSS 5.3) was exploited as a zero-day before the July 14 patch shipped, and CVE-2026-58644 (CVSS 9.8) was added to CISA’s Known Exploited Vulnerabilities catalog on July 16 with a federal remediation deadline of July 19. CVE-2026-50522 had not yet been formally added to CISA KEV at the time of writing, despite confirmed in-the-wild exploitation.
Why It Matters
The machine-key theft is the part CISOs should not gloss over: a stolen ValidationKey/DecryptionKey pair survives the patch. An organization can apply the July 14 update, confirm the CVE is remediated on paper, and still have an attacker walking through the front door with a forged, fully valid authentication token — because nobody rotated the keys the attacker stole before the patch went in. For DACH mid-market organizations, this matters because on-premises SharePoint remains common well beyond the large-enterprise segment — manufacturing, professional services and public-sector bodies that have not migrated to SharePoint Online are all in scope, and audit/compliance frameworks (NIS2, ISO 27001 A.8.24) generally assume that “patched” means “remediated,” which this incident directly contradicts.
What You Should Do Now
- Apply the July 2026 cumulative update for your SharePoint version immediately if you have not already — check the specific KB article for your build via Microsoft’s CVE-2026-50522 advisory.
- Verify exposure: check IIS and SharePoint ULS logs for unusual POST requests to SharePoint service endpoints around and after July 20, and for any outbound connections that don’t match normal SharePoint traffic patterns.
- Rotate ASP.NET machine keys on every on-premises SharePoint farm regardless of patch date — via the SharePoint Products Configuration Wizard or PowerShell — and restart IIS afterward so previously issued tokens are invalidated.
- Enable AMSI Full Request Body Scan mode on SharePoint front-end servers if not already active, and hunt for unexpected service accounts, new admin users, or scheduled tasks created after July 20.
If you cannot confirm your machine keys have never been exposed, treat the rotation step as mandatory rather than optional — there is no way to retroactively determine whether a given server was hit before you started monitoring.
DIESEC Perspective
This is the pattern we keep seeing with edge-facing enterprise platforms: the CVE gets the headline, but the persistence mechanism — stolen keys, forged tokens, backdoor accounts — is what actually determines whether an incident is over. Three SharePoint RCEs in three weeks also means three separate opportunities for an attacker to have gotten in before your organization even started tracking this specific CVE.
Not sure whether your SharePoint environment’s machine keys were exposed before you patched? Contact DIESEC for a rapid SharePoint exposure assessment and machine-key rotation verification.
Sources: The Hacker News | BleepingComputer
Published: 2026-07-23 | Category: Vulnerabilities & Patches | ~4 min read
