Exploitation observed; activity peaked at 41 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-07-25. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
DECLINING
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 1 product
| Date | Total | Labels |
|---|
| 2026-07-15 | 3 | Disclosure2General1 |
| 2026-07-16 | 1 | General1 |
| 2026-07-17 | 2 | Active Exploitation1Patch1 |
| 2026-07-19 | 1 | General1 |
| 2026-07-20 | 2 | Active Exploitation1Disclosure1 |
| 2026-07-21 | 37 | Active Exploitation36Disclosure1 |
| 2026-07-22 | 41 | Active Exploitation35Disclosure1General1Patch2PoC2 |
| 2026-07-23 | 25 | Active Exploitation21Disclosure2General1Patch1 |
| 2026-07-24 | 10 | Active Exploitation5General3Patch2 |
| 2026-07-25 | 3 | Active Exploitation2Disclosure1 |
| 2026-07-26 | 3 | Active Exploitation1Exploit1Patch1 |
| 2026-07-27 | 5 | Active Exploitation2General1Patch1PoC1 |
| 2026-07-28 | 5 | Active Exploitation2General1PoC2 |
| 2026-07-29 | 7 | Active Exploitation3Disclosure2PoC2 |
| 2026-07-31 | 2 | Active Exploitation1Patch1 |
| 2026-08-01 | 1 | Active Exploitation1 |
| 2026-08-03 | 4 | Active Exploitation3Patch1 |
| 2026-08-07 | 1 | Patch1 |
| 2026-08-10 | 1 | Active Exploitation1 |
| 2026-08-11 | 1 | General1 |
| 2026-08-12 | 1 | Active Exploitation1 |
| 2026-08-13 | 1 | Active Exploitation1 |
| 2026-08-14 | 2 | Active Exploitation1Disclosure1 |
| 2026-08-17 | 1 | Active Exploitation1 |
| 2026-08-27 | 1 | Disclosure1 |
| 2026-09-03 | 1 | General1 |
| 2026-09-16 | 1 | Exploit1 |
Deserialization Vulnerability in Microsoft SharePoint CVE-2026-50522 | Severity: CRITICAL Here's the PoC: https://github.com/4minx/CVE-2026-50522
Post summary
The post announces a critical deserialization flaw in Microsoft SharePoint and shares a link to a PoC repository that demonstrates the exploit.
CVE-2026-50522: critical unauthenticated RCE in on-prem SharePoint Server (2016/2019/SE). Get the Nuclei detection template and scan at scale with Sn1per. https://sn1persecurity.com/wordpress/cve-2026-50522-sharepoint-rce-detection-with-sn1per/ #infosec #netsec #bugbounty #redteam #offsec #infosecurity #CVE #exploit #CVE-2026-50522 https://t.co/6Vg5WTK60s
Post summary
The post announces a critical unauthenticated RCE in SharePoint servers, offering a Nuclei detection template for scanning but no exploit or mitigation details.
🚨 Patching your #SharePoint Server may not be enough if it was already exposed. Attackers are exploiting CVE-2026-50522, a critical RCE flaw, to pull machine keys with a single request and maintain access, watchTowr says. A public PoC is available, and this is the third SharePoint Server flaw linked to active exploitation in July 2026. Details: https://thehackernews.com/2026/07/critical-sharepoint-rce-cve-2026-50522.html
Post summary
SharePoint Server CVE‑2026‑50522 is a critical RCE flaw that is actively exploited in the wild, with a public PoC available; patch status is unclear, so administrators must urgently update and investigate exposed systems.
🚨 Exploitation Alert: watchTowr is observing active exploitation of CVE-2026-50522 against on-premise Microsoft SharePoint deployments following the release of public exploit code, with attackers stealing machine keys to retain long-term access. Still not added to CISA KEV. If you were waiting for a signal to patch, this is it. Reach out via our website if you need support.
Post summary
The post announces active exploitation of CVE-2026-50522 against on‑premise SharePoint, with attackers stealing machine keys, and urges immediate patching.
CVE-2026-50522: critical unauthenticated RCE in on-prem SharePoint Server (2016/2019/SE). Get the Nuclei detection template and scan at scale with Sn1per. https://sn1persecurity.com/wordpress/cve-2026-50522-sharepoint-rce-detection-with-sn1per/ #infosec #netsec #bugbounty #redteam #offsec #infosecurity #CVE #exploit #CVE-2026-50522 https://t.co/pXFABssoG3
Post summary
This text announces CVE-2026-50522, a critical unauthenticated RCE in SharePoint Server, and emphasizes the availability of exploit tooling (Nuclei template and Sn1per) for detection and scanning, making 'Exploit' the most fitting classification.
Alert ❗️A newly disclosed vulnerability, tracked as CVE-2026-50522, is rattling enterprise IT teams, as it allows unauthenticated attackers to remotely execute code on on-premises Microsoft SharePoint servers. More Details: https://cybersecuritynews.com/sharepoint-rce-exploited-in-the-wild/ An attacker can send a specially crafted serialized object to a vulnerable endpoint without prior authentication or user interaction, triggering arbitrary code execution in the SharePoint server’s context. #cybersecuritynews
Post summary
CVE-2026-50522 is a newly disclosed unauthenticated RCE vulnerability in Microsoft SharePoint servers, and the text confirms it has already been exploited in the wild.
🚨تحذير🚨 اذا تستخدم SharePoint وممكن الوصول له من الانترنت في منظمتك انصحك تتاكد ان ثغرة CVE-2026-50522 مغلقه تم رصد محاولات كثيره لاستغلال هالثغرة الله يحفظنا من كل شر
Post summary
The post reports numerous attempts to exploit CVE‑2026‑50522 on SharePoint exposed to the Internet and advises verifying that the vulnerability has been patched.
CVE-2026-50522 was demonstrated at #Pwn2Own Berlin by @splitline of DEVCORE Research Team. He earned $100,000 for it. @trendaisecurity customers received protection back on May 19,2026.
Post summary
CVE-2026-50522 was demonstrated at Pwn2Own Berlin and a corresponding patch was released for TrendAI Security customers.
ファイアウォールの管理権限を奪われ、文書共有基盤のSYSTEM権限もなりすまされ、1223万人分のパスワードが流れた。 パッチ適用を「後回し」にしているなら、君の現場も同じ的だ。 ・Check Point管理製品CVE-2026-16232、CISA KEV登録——未認証で管理者権限取得 ・SharePoint CVE-2026-50522、機械鍵窃取でSYSTEM権限なりすまし——PoC後即悪用 ・日本オークション協会、メール不正アクセスで会員情報が漏洩の可能性 ・KDDI、ゼロデイ攻撃でメールアドレス1223万件、パスワード762万件が流出確定 Check PointとSharePointのパッチ、本当に全台終わっているか？ 1223万件流出の余波はこれからが本番だ。パスワード使い回しを今日中に全件洗い出せ。 二次被害を食らってから動いても遅い。
Post summary
The text reports active exploitation of Check Point and SharePoint vulnerabilities with PoC and zero‑day attacks, highlights large-scale data exfiltration, and urges immediate patching.
🚨 Update to our Jul 17 SharePoint report: we now assess the undocumented deserialization vector on our honeypots as likely CVE-2026-50522. The captured requests carry no authentication material, matching 50522's unauthenticated profile. Microsoft describes the paired CVE-2026-58644 as requiring Site Owner auth, which does not fit unauthenticated traffic. CVE-2026-50522 is currently not known to be exploited in-the-wild. Track SharePoint exploitation live http://console.defusedcyber.com/signup
Post summary
The report updates its SharePoint analysis, identifying CVE‑2026‑50522 as an unauthenticated deserialization flaw found on honeypots, with no evidence of wild exploitation or PoC.
🚨 Two critical vulnerabilities in on-premises Microsoft Office SharePoint Server allow RCE without authentication: CVE-2026-58644 and CVE-2026-50522. ▪️ Affected versions: on-premises editions of Microsoft SharePoint Server: SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition ▪️ CVE-2026-58644 marked as exploited ▪️ Patch available. See full advisory for more info: 🔗 https://hubs.ly/Q04pTvsV0
Post summary
Microsoft disclosed two critical RCE vulnerabilities in SharePoint Server, noted active exploitation for one, and provided a patch advisory.
YOU PATCHED THE SERVER. THE ATTACKER IS STILL INSIDE. CVE-2026-50522, AND WHY THE FIX CAME TOO LATE. A critical SharePoint flaw, severity 9.8, under active exploitation this week. Unauthenticated remote code execution on every on-premise SharePoint: 2016, 2019, Subscription Edition. The mechanism most people miss: - The bug lets an attacker run code on the server with no login. - The first thing they steal is not data. It is the machine keys. - Machine keys let them forge valid login tokens for anyone, any time. - So they take the keys, then you patch, and the forged tokens still work. You closed the door after they copied the key to it. That is the trap. A patch stops the next intruder. It does nothing about the credential the last one already walked out with. The takeaway, the one to save: Patching removes the hole. It does not undo what came through it. After any credential-theft bug, rotate the secrets, do not just apply the fix. watchTowr said it plainly: attackers are pulling the keys with a single request, and patching alone is not enough. If you run on-premise SharePoint, the fix from July 14 is step one, rotating machine keys is step two, and step two is the one that actually locks them out.
Post summary
CVE‑2026‑50522 is actively exploited, allowing attackers to steal machine keys via unauthenticated RCE on SharePoint; the publicly available patch closes the hole but does not invalidate stolen credentials, so key rotation is essential.
🛡️We added Check Point SmartConsole vulnerability CVE-2026-16232 & Microsoft SharePoint vulnerability CVE-2026-50522 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/zNyW8fHrGE
Post summary
The tweet announces that CVE-2026-16232 (Check Point SmartConsole) and CVE-2026-50522 (Microsoft SharePoint) have been added to the DHS KEV catalog and urges the application of mitigations, without providing PoC, exploit details, or evidence of active exploitation.
Security Alert: Attackers are actively exploiting a critical Microsoft SharePoint vulnerability (CVE-2026-50522) to steal machine keys and maintain persistent access. even after servers are patched. Organizations using on-premises SharePoint should investigate for signs.
Post summary
The brief alert announces that CVE-2026-50522 is being actively exploited in SharePoint environments, even after patches, and urges organizations to investigate for signs of compromise.
Still seeing substantial amounts of Microsoft SharePoint unpatched instances that have been added to @CISACyber Known Exploited Vulnerability catalog last few weeks. This includes CVE-2026-50522, CVE-2026-56164, CVE-2026-58644 with 878 IPs (1585 FQDNs) unpatched on 2026-07-23 https://t.co/SOfpB5bi3v
Post summary
The tweet reports that several Microsoft SharePoint CVEs remain unpatched and have been added to the CISACyber Known Exploited Vulnerability catalog, implying ongoing exploitation in the wild.
🚨 Critical SharePoint RCE is now being actively exploited. Read here🔗 https://thecybersecguru.com/news/sharepoint-cve-2026-50522-active-exploitation/ A public PoC for CVE-2026-50522 was released, and within hours researchers observed attacks targeting vulnerable on-premises Microsoft SharePoint servers. The biggest concern isn't just Remote Code Execution. Attackers are stealing ASP NET machine keys, allowing them to forge authentication tokens and potentially maintain access even after patching if organizations don't rotate compromised secrets. If your organization still runs SharePoint Server 2016, 2019, or Subscription Edition, patch immediately and review systems for signs of compromise.
Post summary
CVE-2026-50522, a SharePoint RCE, is actively exploited in the wild with a published PoC; attackers also steal machine keys to forge tokens, underscoring the need for immediate patching.
Microsoft SharePointの重大なリモートコード実行の脆弱性CVE-2026-50522に対し、実際の攻撃とみられる活動が観測され、公開PoCも利用可能となった。Microsoftは2026年7月14日に修正プログラムを公開しており、オンプレミス環境の管理者には速やかな更新が求められている。 CVE-2026-50522はCVSSスコア9.8の脆弱性で、信頼できないデータを安全でない形でデシリアライズすることにより、リモートから任意コードを実行できる。Microsoftはネットワーク経由で認証されていない攻撃者が悪用可能で、ユーザー操作も不要としている。Defusedは認証を伴わないSharePointへの不審なリクエストをハニーポットで観測し、この脆弱性を狙った攻撃である可能性が高いと分析した。watchTowrも同様の見解を示している。一方、同時に公開されたCVE-2026-58644はサイト所有者権限が必要であり、今回観測された認証不要のアクセスとは一致しないという。 また、研究者のJanggggg氏はCVE-2026-50522のPoCを公開した。影響を受けるのはSharePoint Server 2016、SharePoint Server 2019、SharePoint Subscription Editionで、2016向けの修正はServerとEnterprise Serverの両方に適用される。Microsoftは2026年7月のセキュリティ更新プログラムの適用を推奨しており、更新できない場合は外部からのアクセス制限や、SharePointのサインインページへの不審なアクセスの調査を案内している。 https://securityonline.info/cve-2026-50522-sharepoint-rce/
Post summary
Microsoft SharePoint CVE‑2026‑50522, a high‑severity RCE flaw, is being actively exploited in the wild, a public PoC exists, and a patch was released on July 14; affected organizations should update promptly and apply mitigation measures.
Cyber bro use grok 4.5 and Ask: “Crawl X and find me recent exploited CVEs” I did exactly that 30 mins ago. Here’s what’s actually popping with active exploitation chatter right now not just another CVE list: - wp2shell (CVE-2026-63030 & 60137) WordPress core pre-auth RCE chain already live in the wild. - Webshells dropping, Free checker: wp2shell. com toUpdate to 6.9.5 / 7.0.2 NOW if you’re on vulnerable versions. - CVE-2026-50522 SharePoint on-prem deserialization RCE. Attackers stealing machine keys for persistence after public exploit dropped. - Exploitarium dump One researcher just dropped 130+ working zero-days across 22 projects (Linux DirtyClone LPE, Samba CVSS 10, etc.) The speed of weaponization is insane. Your patching process needs to match. This is how I cut through the noise on X.
Post summary
The post confirms real‑world exploitation of several CVEs, provides patch information, and references available exploit code.
⚠️Alerte CERT-FR⚠️ Les vulnérabilités CVE-2026-50522 et CVE-2026-58644 permettent une exécution de code arbitraire à distance non authentifiée sur SharePoint et sont activement exploitées. https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-008/
Post summary
The French CERT alert states that CVE-2026-50522 and CVE-2026-58644 enable unauthenticated remote code execution on SharePoint and are currently being actively exploited in the wild.
SharePoint's JWT token validation pipeline just became the latest example of a pattern we keep seeing: authentication bypass through chained weaknesses that no single check catches. CVE-2026-55040 combines four distinct flaws: disabled signature requirements, x5t resolution without verification, issuer validation that accepts unregistered certificates, and non-cryptographic signature checks. The result allows an unauthenticated attacker to forge a valid JWT and impersonate any SharePoint site user or administrator. Rapid7 released a PoC on August 10. Exploitation attempts spiked from July 19 to August 13, with eight of 12 recorded attempts occurring on August 12 and 13. The public PoC is now being used in the wild. This is the fifth SharePoint vulnerability exploited this year, following CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522. Authentication bypass vulnerabilities don't usually start with a single catastrophic bug. They start with multiple small flaws that, when chained together, create a path that bypasses every control in the stack. The engineering assumption that each layer will catch what the previous layer missed is what fails. When you disable signature verification and then build custom validation logic that doesn't verify signatures, you've just moved the failure point. How are you validating that your authentication logic actually verifies what it claims to verify and not just accepting tokens that look like they should work?
Post summary
Rapid7’s PoC for CVE-2026-55040, coupled with documented exploitation attempts—eight of twelve on August 12‑13—shows the vulnerability is actively exploited in the wild, underscoring a real‑world threat.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | microsoft | sharepoint_server | - | - | - |
| App | microsoft | sharepoint_server | 2016 | - | - |
| App | microsoft | sharepoint_server | 2019 | - | - |