TL;DR
- what: CVE-2026-50522, a critical deserialization RCE in Microsoft SharePoint Server, is being actively exploited after a public proof-of-concept dropped.
- impact: Attackers are extracting IIS machine keys in a single HTTP request, letting them forge authentication material and retain access to servers even after the patch is applied.
- fix: Apply Microsoft's July 2026 Patch Tuesday update for SharePoint Server, then rotate machine keys and credentials on every exposed instance because patching alone does not evict an attacker who already has the keys.
- who: Every organization running on-premises SharePoint Server Subscription Edition, 2019, or 2016, particularly internet-facing deployments.
Attackers are stealing IIS machine keys from on-premises SharePoint servers with a single HTTP request. watchTowr confirmed active exploitation of CVE-2026-50522 following the release of a public proof-of-concept exploit, and the operational consequence is blunt: if your server was reachable and unpatched, applying the patch does not remove the attacker.
CVE-2026-50522 carries a CVSS score of 9.8. It is a deserialization of untrusted data flaw in Microsoft Office SharePoint that permits code execution over the network. Microsoft patched it in the July 2026 Patch Tuesday release and credited DEVCORE researcher "splitline" with the discovery. Microsoft tagged it "Exploitation More Likely" at release. That assessment held.
The Authentication Discrepancy Matters
Microsoft's advisory describes the flaw as requiring an attacker "authenticated as at least a Site Owner" who "could write arbitrary code to inject and execute code remotely on the SharePoint Server." The vector is Network (AV:N), remotely exploitable from the internet, with Low attack complexity (AC:L) because no significant prior knowledge of the system is needed and the payload achieves repeatable success.
Field telemetry tells a different story. Defused Cyber reported threat actors delivering a .NET deserialization payload to a SharePoint sign-in endpoint, and noted that "the captured requests carry no authentication material, matching 50522's unauthenticated profile." If observed exploitation requires no credentials, the Site Owner prerequisite in the vendor advisory is not the control your risk model should lean on. Treat this as unauthenticated RCE until proven otherwise.
⚠️ Patching Is Not Remediation Here — watchTowr's guidance is explicit: "Attackers are pulling SharePoint machine keys via a single request. Patching is not enough; defenders should rotate credentials on any assets that may have been exposed." Machine keys stolen before patching remain valid after patching. An attacker holding your ValidationKey and DecryptionKey can forge signed and encrypted ViewState payloads and walk back into a fully patched server.
Why Machine Key Theft Is the Real Payload
ASP.NET machine keys sign and encrypt ViewState. SharePoint runs on ASP.NET. Once an attacker holds the machineKey values from web.config, they can craft ViewState blobs that the server accepts as legitimate and deserializes into code execution. No exploit required at that point. The vulnerability was the door; the machine key is the copied key to the lock.
This is why the single-request detail matters operationally. There is no long exploitation chain to catch in logs, no staged payload delivery, no lateral movement to alert on. One request in, keys out. Any organization that was exposed during the window between PoC publication and patch deployment should assume key compromise rather than trying to prove it did not happen.
Third Flaw in the Same Cycle
CVE-2026-50522 is the third SharePoint Server vulnerability from the July 2026 patch cycle to see active exploitation. The other two, CVE-2026-56164 (CVSS 5.3) and CVE-2026-58644 (CVSS 9.8), were weaponized as zero-days before Microsoft shipped fixes.
CISA has since warned that threat actors are exploiting multiple SharePoint Server vulnerabilities to gain unauthorized access to on-premises instances. The agency named CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644. Per CISA, "these vulnerabilities affect all supported on-premises SharePoint Server versions (Subscription Edition, 2019, and 2016) and involve establishing remote code execution (RCE) and post-exploitation activities, such as stealing Internet Information Services (IIS) machine keys and performing deserialization techniques, to gain persistence and deploy malware."
The pattern across all of these is consistent: get RCE, take the machine keys, establish persistence that survives patching. Defenders treating each CVE as an isolated patch task are missing the shared post-exploitation objective.
What To Do Now
- Apply the July 2026 Patch Tuesday updates for SharePoint Server across Subscription Edition, 2019, and 2016. This is table stakes, not remediation.
- Rotate ASP.NET machine keys on every SharePoint server that was internet-reachable. Generate new ValidationKey and DecryptionKey values, then restart IIS so the new keys take effect.
- Rotate service account credentials, farm account passwords, and any secrets stored in or reachable from the SharePoint farm.
- Hunt for anomalous POST requests to SharePoint sign-in endpoints carrying serialized .NET payloads, particularly requests with no authentication material attached.
- Review IIS logs for single-request patterns targeting SharePoint endpoints around and after the July 2026 patch release date.
- Audit web shells and unexpected files in SharePoint layouts directories, a standard follow-on to SharePoint RCE.
- Pull internet-facing SharePoint behind a VPN or reverse proxy with authentication if business requirements permit.
Rotation Order Matters — Rotate machine keys after patching, not before. Rotating first on an unpatched server hands the attacker a fresh opportunity to steal the new keys through the same unfixed flaw. Patch, verify the patch applied, then rotate, then restart IIS.
Assessment
The public PoC collapsed the exploitation window. Microsoft's own "Exploitation More Likely" rating on a CVSS 9.8 deserialization bug in a widely deployed on-premises product was a clear signal, and the gap between advisory and in-the-wild exploitation closed within days of the PoC dropping.
On-premises SharePoint has become a reliable target class. Three exploited flaws in one patch cycle, six CVEs in CISA's warning, and a consistent post-exploitation playbook centered on machine key theft. If you still run SharePoint on-prem and it faces the internet, the assumption should be that it has been probed. Rotate the keys.
Originally published on RedEye Threat Intelligence.
Top comments (0)