CRITICAL: Microsoft SharePoint RCE CVE-2026-50522 Exploited in the Wild to Steal Machine Keys

Pour one out for every SharePoint admin who was hoping for a quiet July. Microsoft's on-premises collaboration server is once again the belle of the ball for attackers, and this time the invitation went out publicly. A critical remote code execution flaw tracked as CVE-2026-50522, carrying a near maximum CVSS score of 9.8, is being actively exploited in the wild after proof-of-concept code surfaced online. If you run SharePoint Server on premises, this is squarely in the drop everything and patch this now category.

The vulnerability lives in how SharePoint deserializes untrusted data, a category of bug that has haunted .NET applications for the better part of a decade. Specifically, the flaw stems from insufficient validation before SharePoint deserializes user provided data inside the SessionSecurityTokenHandler class, the component responsible for handling federated authentication tokens. When an application blindly trusts a serialized object and reconstructs it in memory without checking what it actually contains, an attacker can smuggle in a payload that executes code the moment the object comes back to life. That is precisely what is happening here, and the results are exactly as ugly as they sound.

The attack itself is elegant in the way that only truly dangerous exploits are. Researchers watching real world traffic have documented threat actors crafting a malicious .NET BinaryFormatter payload and embedding it as a cookie inside a forged WS-Federation sign-in response. That poisoned token gets delivered to SharePoint's /_trust/default.aspx endpoint, and when the vulnerable deserialization path processes it, arbitrary code executes on the server with the privileges of the SharePoint application. Microsoft's own writeup notes that a network based attacker authenticated as at least a Site Owner can write and execute arbitrary code, but the captured exploitation attempts tell an even scarier story. Defenders observed requests pulling SharePoint machine keys with a single request that carried no authentication material whatsoever. In plain English, the theoretical bar of Site Owner access is being cleared entirely by attackers in the field, and they are walking straight in the front door.

The technical characteristics explain why this one deserves your full attention. The attack vector is Network with low attack complexity, which in Microsoft's own language means an attacker does not require significant prior knowledge of the system and can achieve repeatable success. Microsoft rated the exploitability as Exploitation More Likely even before the public code dropped, and the internet has now confirmed that assessment with enthusiasm. Credit for the discovery goes to DEVCORE researcher splitline, a name that SharePoint defenders may recognize from previous rounds of on-premises pain. The affected footprint covers on-premises x64 deployments of Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. If your organization moved to SharePoint Online, you can exhale, because this is an on-premises problem. Everyone still running their own farm needs to keep reading.

The exploitation timeline is a textbook example of how fast the window slams shut these days. Early warning firm Defused Cyber first detected suspicious activity involving an undocumented SharePoint deserialization vector on July 17, before the flaw even had a formal CVE attached to it. Three days later, on July 20, the team at watchTowr identified public proof-of-concept exploit code, and within hours their global honeypot network captured live exploitation attempts that successfully compromised target systems. That is the entire lifecycle from private attack to mass exploitation compressed into roughly seventy two hours. It is the clearest illustration yet of the industry lament that n-day is becoming n-hour. The days when you could quietly schedule a patch for the next maintenance window and sleep soundly are gone, at least for internet facing enterprise software with a public exploit attached.

Here is the part that keeps incident responders up at night. The endgame for these attackers is not just popping a shell, it is stealing the SharePoint machine keys. Those cryptographic materials, the validation and decryption keys that SharePoint uses to sign and encrypt authentication tokens and view state, are the digital equivalent of the master key to the building. Once an attacker exfiltrates them, they can forge valid authentication tokens at will, impersonate any user, and access SharePoint sites and documents with the privileges of whatever identity they choose to fabricate. Crucially, this persistence survives patching. You can apply Microsoft's update, close the deserialization hole, pat yourself on the back, and the intruder who already grabbed your machine keys retains a working skeleton key to your environment. Patching stops the bleeding but it does not evict a guest who already made a copy of the locks.

So what do you actually do about it. First and most obviously, apply the July 2026 Microsoft security updates that address CVE-2026-50522, and do it today rather than during some idealized future change window. This fix shipped as part of Microsoft's monthly Patch Tuesday rollout, so it should be readily available through your normal update channels. Patching, however, is only step one, and treating it as the finish line is the mistake that will haunt organizations for months. Because machine key theft is the documented objective, every SharePoint farm that was reachable and unpatched during the exposure window should be treated as potentially compromised and have its machine keys rotated. Rotating those keys invalidates any tokens an attacker may have forged and slams the persistence door shut. While you are at it, rotate credentials on any adjacent assets that the SharePoint service account can touch, because lateral movement from a compromised SharePoint box is a well worn path.

On the detection side, dig into your logs for the fingerprints of this campaign. Hunt for suspicious requests to the /_trust/default.aspx endpoint, particularly any carrying unusual WS-Federation sign-in responses or oversized cookies that could be hiding a serialized payload. Watch for unexpected machine key access patterns and for authentication tokens being used in ways that do not match normal user behavior, such as a single account suddenly appearing from wildly different locations or logging in outside its usual hours. Because the successful attacks in the wild required no authentication material, do not fall into the trap of only scrutinizing authenticated sessions. The anomalous requests may look like unauthenticated noise right up until the moment they hand someone your keys. If you have the ability to restrict access to the SharePoint sign-in and trust endpoints, or to place the whole farm behind a VPN or web application firewall with deserialization aware rules, now is an excellent time to do exactly that.

The uncomfortable meta-lesson here is one the industry keeps refusing to internalize. On-premises SharePoint has become a recurring headline for a reason. It is deeply embedded in enterprise workflows, it is often internet exposed because collaboration demands it, and it sits on a sprawling legacy codebase full of the kind of deserialization patterns that modern secure development would never allow. Every few months a new critical flaw in this family emerges, gets a public PoC, and turns into a mass exploitation event before defenders finish their morning coffee. If your organization is still running its own SharePoint farm, this incident is a fresh reminder that owning the server means owning the entire responsibility for defending it at machine speed.

For managed service providers and security shops, campaigns like this are a genuine business inflection point, not just a fire drill. Every client running on-premises SharePoint is a candidate for an urgent patch verification and machine key rotation engagement, and the honest conversation about why patching alone is insufficient positions you as the advisor who actually understands the threat rather than the vendor who just forwards Microsoft bulletins. This is also the ideal moment to pitch continuous vulnerability management, dark web and exposure monitoring for leaked credentials and machine keys, and managed detection services tuned to exactly the endpoint and log signals described above, because a client who just watched n-day become n-hour is finally ready to pay for the speed they have been putting off.