A critical deserialization flaw in Microsoft SharePoint, tracked as CVE-2026-50522, is being exploited in the wild after proof‑of‑concept code was released online. The vulnerability allows authenticated Site Owners to run arbitrary code on vulnerable servers without any user interaction, posing an immediate risk to organizations that rely on the platform for collaboration. Security researchers first warned of the issue after observing active attacks following the public PoC release (SecurityAffairs reported), prompting urgent calls for patching.
CVE-2026-50522 carries a CVSS score of 9.8, reflecting its critical severity, and stems from an insecure deserialization of user‑supplied data within SharePoint’s ObjectCache component. An attacker who holds Site Owner privileges can craft a malicious payload that, when processed by the server, executes arbitrary code in the context of the SharePoint application. A related flaw, CVE-2026-58644, shares the same score and can be chained with CVE-2026-50522 to increase impact, though each can be exploited independently.
Exploitation of CVE-2026-50522 does not require user interaction; a single specially crafted request can trigger the deserialization flaw and give the attacker remote code execution. Researchers have shown that the same request can be used to extract the SharePoint machine key, which, if compromised, enables an attacker to forge authentication tokens and maintain persistence. This means that even after removing the malicious payload, the attacker may retain long‑term access unless the key is rotated and the server is patched.
The activity was first spotted by the security firm WatchTowr, which issued an alert after seeing the flaw actively used in attacks (WatchTowr LinkedIn post). Although the proof of concept has been made public, no specific threat actor has been linked to the campaigns so far. The ease of exploitation and the availability of exploit code have raised concerns that more groups may begin targeting unpatched SharePoint instances in the near future.
Defenders should prioritize applying the July 2026 security update from Microsoft that addresses CVE-2026-50522 and CVE-2026-58644. Administrators must review SharePoint logs for unusual deserialization requests, especially those containing unfamiliar payloads or originating from unexpected internal addresses. Rotating the SharePoint machine key and any associated service account credentials is recommended to invalidate any tokens that may have been stolen. Until patches are applied, consider limiting Site Owner rights to trusted accounts and enforcing stricter access controls on the admin portal.
Network segmentation can help contain a breach by separating SharePoint servers from critical internal systems, reducing the chance that an attacker moves laterally after gaining code execution. Disabling unused SharePoint features and web parts limits the attack surface, while outbound traffic monitoring may reveal attempts to contact external command‑and‑control servers. Enforcing multi‑factor authentication for all privileged accounts adds another barrier, ensuring that stolen keys alone are insufficient for full compromise.
Applying the available patches promptly, combined with vigilant monitoring and credential rotation, significantly lowers the risk of lasting compromise. While the vulnerability is severe, the fix is straightforward and the mitigations outlined above are within the reach of most security teams. Staying informed about emerging exploits and maintaining a layered defence strategy will help organisations defend against similar threats in the future.