A critical SharePoint vulnerability patched in Microsoft’s July 2026 security updates is now under active exploitation, with attackers stealing machine keys that let them retain access to compromised servers even after patching.

The flaw, tracked as CVE-2026-50522 (CVSS 9.8), is a deserialization-of-untrusted-data vulnerability in Microsoft Office SharePoint that allows a remote, unauthenticated attacker to execute code over the network. Microsoft credited DEVCORE with the discovery. At the time of patching, the advisory did not mark the flaw as actively exploited, though it flagged an increased likelihood of exploitation.

From PoC to active attacks in hours

Offensive security firm watchTowr says exploitation began almost immediately after a working proof-of-concept exploit surfaced publicly. According to the company, its global honeypot network, Attacker Eye, detected exploitation attempts using the PoC within hours of its release on July 20, with some attempts successfully compromising target systems.

Threat intelligence company Defused had actually observed related activity earlier, spotting an undocumented SharePoint deserialization vector in attacks as early as July 17. At the time, Defused could not attribute the activity to a specific vulnerability, but has since said the attacks were likely driven by exploitation of CVE-2026-50522.

How the exploit works

A PowerShell-based demonstrative exploit for the flaw, published on GitHub by researcher Janggggg, attempts to trigger remote code execution by delivering a malicious .NET BinaryFormatter payload inside the cookie of a forged SecurityContextToken. The payload is embedded within a WS-Federation sign-in response posted to SharePoint’s /_trust/default.aspx endpoint. If the vulnerable deserialization path processes the token, arbitrary code execution follows on the SharePoint server.

It remains unclear whether the observed attacks used this specific public PoC, but researchers note it appears structurally and technically legitimate.

Why machine key theft matters

Attackers exploiting CVE-2026-50522 are reportedly harvesting machine keys from compromised servers. Possession of these keys lets an attacker forge valid authentication tokens, impersonating legitimate users and accessing SharePoint sites and documents with the privileges of the forged identity, a persistence technique that survives routine patching.

Recommended actions

  • Apply Microsoft’s July 2026 SharePoint security updates immediately.
  • Rotate machine keys and credentials on any SharePoint asset that may have been exposed, even after patching.
  • Review logs for anomalous activity against the /_trust/default.aspx endpoint.
  • Treat on-premise SharePoint deployments as high priority given confirmed unauthenticated RCE exploitation.