CVE-2026-50522: SharePoint Deserialization RCE Under Active Exploitation

TL;DR - A Site Owner-authenticated attacker can deserialize untrusted data to run arbitrary code on on-premises SharePoint Server. - Security vendor watchTowr has observed active exploitation following a public proof-of-concept, with attackers stealing SharePoint machine keys in a single request. - Patching alone is not enough — rotate credentials and machine keys on any exposed instance.

Vulnerability at a Glance

CVE-2026-50522 is a critical deserialization-of-untrusted-data vulnerability (CWE-502) in Microsoft Office SharePoint, credited to DEVCORE researcher “splitline” and fixed in Microsoft’s July 2026 Patch Tuesday release. Microsoft rates it “Exploitation More Likely,” and that assessment has already played out: on July 21, 2026, security vendor watchTowr reported active exploitation against on-premises SharePoint deployments following the release of a public proof-of-concept exploit.

This is the third SharePoint Server vulnerability disclosed this cycle to see active exploitation, after CVE-2026-56164 and CVE-2026-58644 (CVSS 9.8) were weaponized as zero-days before their fixes shipped. CISA has separately warned that threat actors are chaining multiple SharePoint vulnerabilities — including CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644 — to gain unauthorized access to on-premises instances and steal IIS machine keys for persistence.

What Is This Vulnerability?

Per Microsoft’s advisory, “in a network-based attack, an attacker authenticated as at least a Site Owner could write arbitrary code to inject and execute code remotely on the SharePoint Server.” The root cause is CWE-502: SharePoint deserializes untrusted data without adequate validation, and a Site Owner-level session is enough to reach that deserialization path and achieve remote code execution.

Microsoft’s own scoring notes explain why this is rated so severely despite requiring authentication: “The attack vector is Network (AV:N) because this vulnerability is remotely exploitable and can be exploited from the internet. The attack complexity is Low (AC:L) because an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component.” In other words, once an attacker has (or obtains) Site Owner access — a role that is often delegated broadly in real deployments — exploitation is reliable and requires no special conditions.

What elevates this from “patch when convenient” to “patch now” is what watchTowr has observed post-exploitation: attackers pulling SharePoint machine keys via a single request against vulnerable, unpatched instances. Machine keys are what SharePoint uses to sign and validate ASP.NET view state; stealing them lets an attacker forge trusted requests and maintain persistent access even after the underlying deserialization bug is patched, unless the keys themselves are rotated.