VulnSocial
← Back to blog

CVE-2026-50522 – Critical Unauthenticated RCE in Microsoft SharePoint Server

Key takeaways

  • Critical remote code execution (RCE) with CVSS 9.8
  • Unauthenticated attacker can execute arbitrary code and steal IIS machine keys
  • Affects on‑prem SharePoint Server 2016, 2019, and Subscription Enterprise
  • Public PoC released on 2026‑07‑21; active exploitation confirmed
  • Immediate patch and rotate IIS machine keys

Overview

The vulnerability identified as CVE-2026-50522 is a network‑accessible, unauthenticated remote code execution flaw in Microsoft SharePoint Server. It stems from a deserialization issue (CWE‑502) that allows an attacker to send a crafted serialized object to a vulnerable endpoint, resulting in arbitrary code execution with the privileges of the SharePoint web application. The Microsoft Security Response Center (MSRC) assigned a Critical severity rating with a CVSS v3.1 base score of 9.8. The vulnerability was added to the U.S. Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog on 2026‑07‑22, triggering urgent remediation guidance.

A public proof‑of‑concept (PoC) exploit was released on 2026‑07‑21, and threat intel sources reported a rapid surge in exploitation activity across multiple days, with dozens of active exploitation reports and PoC mentions in the following week. Attackers have been observed leveraging this flaw to extract the IIS machine keys from compromised SharePoint servers, a step that enables persistent access and further lateral movement.

For live threat activity, exploit timelines, and detailed signal data, see the VulnSocial CVE page.

Technical Details

  • Root cause: Deserialization of untrusted data in SharePoint's server‑side components (CWE‑502). The vulnerable code path processes serialized objects without sufficient validation.
  • Attack vector: An unauthenticated attacker sends a specially crafted HTTP request containing a malicious serialized payload to a SharePoint endpoint (e.g., a web service or REST API). The payload triggers object deserialization, leading to arbitrary code execution.
  • Impact: The attacker can execute commands in the context of the SharePoint application pool, which runs under the IIS service account. This grants access to the server’s IIS machine keys, enabling the creation of forged authentication tokens and long‑term persistence.
  • Exploitation flow (simplified):
    1. Identify a reachable SharePoint Server instance.
    2. Deliver the malicious serialized payload via an HTTP POST.
    3. The server deserializes the payload, executing attacker‑controlled code.
    4. The code reads the IIS machine key files and exfiltrates them.
    5. The attacker uses the stolen keys to forge authentication cookies or tokens for future access.

The public PoC demonstrates the full chain, confirming that the vulnerability can be weaponized with minimal effort.

Severity & Impact

CVE IDSeverityCVSSCWE
CVE-2026-50522Critical9.8CWE-502

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H – remote, low complexity, no authentication, high confidentiality, integrity, and availability impact.

The combination of unauthenticated network access and the ability to steal cryptographic keys makes this flaw exceptionally dangerous for any organization that exposes SharePoint Server to the internet or untrusted internal networks.

Affected Products

  • Vendor: Microsoft
  • Product: SharePoint Server
  • Versions: 2016, 2019, and the Subscription Enterprise (SE) edition

For a complete list of affected versions and build numbers, see the VulnSocial CVE page.

Actionable Insights

  • Prioritize patching – Apply the Microsoft security update immediately (patch) and verify the patch level on all SharePoint servers.
  • Rotate IIS machine keys – After patching, generate new machine keys and replace the old ones to invalidate any keys that may have been exfiltrated.
  • Deploy detection signatures – Use available detection templates (e.g., Nuclei, Sn1per) to scan for the malicious payload or anomalous HTTP requests to SharePoint endpoints.
  • Monitor network traffic – Look for unusual POST requests to SharePoint web services, especially from external IPs. Correlate with logs from IIS and SharePoint diagnostic logs.
  • Restrict exposure – If possible, block inbound traffic to SharePoint servers from the internet, or place them behind a web application firewall (WAF) with strict request validation.
  • Leverage threat intel – Track real‑time exploitation signals on the VulnSocial CVE page to stay aware of emerging attack patterns.

Remediation & Mitigation

  1. Patch the affected SharePoint servers – Download and install the security update from the Microsoft advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522.
  2. Rotate IIS machine keys – Run the following commands on each server after patching (run as Administrator): 
    %windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe -px "iisConfigurationKey" "C:\temp\iisConfigKey.xml" -pri
%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe -px "iisWasKey" "C:\temp\iisWasKey.xml" -pri
# Generate new keys
%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe -pz "iisConfigurationKey"
%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe -pz "iisWasKey"
iisreset
    Replace the old key files with the newly generated ones and restart IIS.
  3. Validate the patch – Confirm the installed KB number matches the advisory and that the vulnerable endpoint no longer accepts the malicious payload.
  4. Implement detection – Deploy community‑maintained detection templates (e.g., Nuclei) to scan for the exploit pattern across your environment.
  5. Review access controls – Ensure that SharePoint services are not exposed to untrusted networks and that least‑privilege principles are applied to the IIS application pool identity.

Bottom Line

CVE-2026-50522 is a Critical unauthenticated RCE flaw in Microsoft SharePoint Server with a CVSS score of 9.8. Public exploit code has led to active exploitation, including theft of IIS machine keys. Organizations must patch immediately, rotate compromised keys, and deploy detection controls to mitigate further risk.

References

#hashtags: #CVE #CVE202650522 #Critical #RCE #SharePoint #Microsoft #CISAKEV