CVE-2026-50522: Microsoft SharePoint — Persistent RCE, Key Theft, Active Exploitation (July 2026)

CVE-2026-50522 — Microsoft SharePoint

CVE-2026-50522 is a critical vulnerability in Microsoft SharePoint that enables remote code execution (RCE) and has been actively exploited in the wild. Attackers are using this flaw to steal SharePoint machine keys, allowing them to maintain persistent, unauthorized access to enterprise environments. The vulnerability was patched on July 14, 2026, but exploitation began shortly after public proof-of-concept code was released.

Attack Vector

Attackers leverage CVE-2026-50522 to execute arbitrary code on vulnerable SharePoint servers remotely. Successful exploitation requires network access to the SharePoint instance. Once compromised, threat actors extract machine keys, which are then used to sign authentication tokens or decrypt sensitive data, enabling lateral movement and long-term persistence. No user interaction is required, and exploitation can occur against internet-facing or internal deployments.

Who Is at Risk

All organizations running unpatched Microsoft SharePoint servers are at risk, regardless of deployment size or region. Both on-premises and hybrid SharePoint environments are vulnerable. Security firms have confirmed exploitation across multiple sectors globally. Any organization that has not applied the July 14, 2026 patch is exposed to credential theft and persistent compromise.

Patch & Mitigate

• Patch: Apply the Microsoft SharePoint security update released July 14, 2026, immediately to all affected servers.
• Workaround: None available; patching is mandatory.
• Detect: Review SharePoint and Windows event logs for anomalous authentication activity, unexpected changes to machine key files, and suspicious process launches. Monitor for unauthorized access to sensitive SharePoint resources and unusual outbound connections from SharePoint servers.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit the vulnerability to gain a foothold on SharePoint servers.
• TA0005 — Defense Evasion: Stolen machine keys allow attackers to forge tokens and evade authentication controls.
• TA0003 — Persistence: Compromised keys enable ongoing unauthorized access even after patching, unless credentials are rotated.

Source: https://www.securityweek.com/fourth-sharepoint-vulnerability-exploited-in-past-months-wave-of-attacks/