CISA Flags CVE-2026-50522 in KEV, Warns of SharePoint RCE Risk

The Known Exploited Vulnerabilities (KEV) Catalog, maintained by CISA, serves as a comprehensive source for identifying vulnerabilities that are actively exploited in the wild. It is designed to assist organizations in prioritizing their vulnerability management efforts. The catalog highlights the importance of addressing these vulnerabilities quickly, providing insights into mitigation strategies, and offering access in various formats such as CSV and JSON.

One specific vulnerability listed is CVE-2026-50522, which affects Microsoft SharePoint and could allow unauthorized code execution. Users are encouraged to apply mitigations as per vendor instructions and stay updated by subscribing to catalog updates.

CVE-2026-50522 coverage
Published (UTC)	Outlet	Headline
Tue 21 Jul · 15:20 UTC	The Hacker News	SharePoint flaw CVE-2026-50522 under active attack after PoC leak
Tue 21 Jul · 22:56 UTC	Security Affairs	CVE-2026-50522: SharePoint Flaw Lets Site Owners Run Remote Code
Wed 22 Jul · 11:40 UTC	SecurityWeek	Fourth SharePoint Vulnerability Exploited in Past Month’s Wave of Attacks
Wed 22 Jul · 20:21 UTC	CISA	CISA Adds CVE-2026-50522 to Known Exploited Vulnerabilities Catalogue
Wed 22 Jul · 22:03 UTC	CISA	CISA Flags CVE-2026-50522 in KEV, Warns of SharePoint RCE Risk (this article)
Thu 23 Jul · 04:06 UTC	SecurityOnline	GitHub Actions Abused to Steal Credentials from PHP Packages
Thu 23 Jul · 04:07 UTC	SecurityOnline	Two Active BIND Exploits Highlighted as Nine Flaws Patched
Thu 23 Jul · 21:01 UTC	Security Affairs	U.S. CISA adds Microsoft SharePoint and Check Point SmartConsole flaws to its Known Exploited Vulnerabilities catalog
Mon 27 Jul · 02:21 UTC	SecurityOnline	UK firms must patch now as CISA flags six active exploits
Fri 2 Oct · 10:05 UTC	SecurityWeek	Warlock Ransomware Expands SharePoint Attacks Against Critical Sectors

CVE-2026-50522 coverage

Published (UTC)

Outlet

Headline

Tue 21 Jul · 15:20 UTC

The Hacker News

SharePoint flaw CVE-2026-50522 under active attack after PoC leak

Tue 21 Jul · 22:56 UTC

Security Affairs

CVE-2026-50522: SharePoint Flaw Lets Site Owners Run Remote Code

Wed 22 Jul · 11:40 UTC

SecurityWeek

Fourth SharePoint Vulnerability Exploited in Past Month’s Wave of Attacks

Wed 22 Jul · 20:21 UTC

CISA

CISA Adds CVE-2026-50522 to Known Exploited Vulnerabilities Catalogue

Wed 22 Jul · 22:03 UTC

CISA

CISA Flags CVE-2026-50522 in KEV, Warns of SharePoint RCE Risk (this article)

Thu 23 Jul · 04:06 UTC

SecurityOnline

GitHub Actions Abused to Steal Credentials from PHP Packages

Thu 23 Jul · 04:07 UTC

SecurityOnline

Two Active BIND Exploits Highlighted as Nine Flaws Patched

Thu 23 Jul · 21:01 UTC

Security Affairs

U.S. CISA adds Microsoft SharePoint and Check Point SmartConsole flaws to its Known Exploited Vulnerabilities catalog

Mon 27 Jul · 02:21 UTC

SecurityOnline

UK firms must patch now as CISA flags six active exploits

Fri 2 Oct · 10:05 UTC

SecurityWeek

Warlock Ransomware Expands SharePoint Attacks Against Critical Sectors

CISA Flags CVE-2026-50522 in KEV, Warns of SharePoint RCE Risk

Story timeline CVE-2026-50522

Sources

On this device

Intel

Settings

Keyboard shortcuts