Originally published at endoflife.ai.
On July 14, 2026, two things happened to SharePoint Server 2016 and 2019 at once: they reached end of extended support, and they received their final security update. At the time, the obvious question was how long before the next critical flaw showed up with no fix behind it.
The answer turned out to be eight days.
On July 22, CISA added CVE-2026-50522 to its Known Exploited Vulnerabilities catalog - a deserialization flaw in SharePoint Server rated CVSS 9.8, yielding remote code execution. A public proof-of-concept exploit appeared on July 20; active exploitation followed within hours. Federal agencies were given until July 25 to remediate. Three days.
The twist that matters
This one was patched for 2016 and 2019 - in the July 14 updates, the same batch that closed CVE-2026-58644, and the same batch that was their last ever.
So a fully updated 2016 or 2019 farm is covered against CVE-2026-50522. That is exactly why it's worth writing about: it is the final flaw those versions are on the right side of. Every SharePoint vulnerability disclosed from here on has no fix for 2016 and 2019 - at any price.
Why "it was patched" is not the reassurance it sounds like
Two things are true at once:
If you applied the July 14 updates, you are protected against this specific flaw. That update earned its keep twice over - two critical, exploited-in-the-wild RCEs in one drop.
If you did not, you now have a public exploit and active in-the-wild attacks pointed at a version that can never be patched again. The July 14 update is still available and you should apply it today - but there is no next one. For a supported product, "we're a bit behind on patching" is a scheduling problem. For SharePoint 2016 and 2019 after July 14, it is the difference between the last fix and no fix.
There is no Extended Security Updates program for SharePoint - unlike Windows 10 or Windows Server. No paid extension, no third-party equivalent, because nobody outside Microsoft can patch proprietary SharePoint code. July 14 was a hard cutoff.
This is a base rate, not a bad week
CISA has flagged a run of actively exploited SharePoint vulnerabilities in a matter of months - CVE-2026-56164, CVE-2026-58644, and now CVE-2026-50522 among them - and issued a dedicated SharePoint hardening alert on July 14. SharePoint on-premises is internet-facing, holds the documents worth stealing, and sits inside the Windows identity fabric. That cadence does not slow down because a support date passed. What changed is that, from the next flaw onward, the response option for 2016 and 2019 is gone.
What to do this week if you're on 2016 or 2019
- Confirm the July 14, 2026 updates are installed on every farm. A public exploit is circulating.
- Check for prior compromise. CISA has reported attackers harvesting IIS machine keys from SharePoint to establish persistence - stolen keys survive patching. If a farm was internet-facing and unpatched during the exploitation window, rotate machine keys and treat an incident review as part of the response.
- Take internet-facing farms off the public internet. Migration is a quarter of work; removing internet exposure is an afternoon, and it converts an unpatchable internet-facing target into an unpatchable internal one.
- Pick a destination: SharePoint Server Subscription Edition (on-premises, subscription licensing), SharePoint Online in Microsoft 365 (farm solutions don't migrate), or another platform. A typical enterprise migration runs 6-18 months - the clock is already running.
The general lesson
An end-of-support date changes nothing about your software and everything about your options. CVE-2026-50522 is the cleanest possible demonstration: identical bug class, identical attacker behavior, identical severity to the flaws before it - and the only variable that moved is whether a fix exists on the other side. On July 13 it would have. Going forward it won't.
Plan around the last patch date, not the last release date - and check whether a product even has an ESU-style escape hatch before assuming a deadline is soft. SharePoint doesn't.
Track end-of-life dates and risk for 480+ products at endoflife.ai - or check the full SharePoint timeline.
Top comments (0)