The Short Version
A critical SharePoint deserialization flaw is under active exploitation, and attackers are leveraging the vulnerability to extract IIS machine keys from affected servers through a single malicious request. Those keys let them forge authentication tokens that SharePoint accepts as legitimate, and that access does not go away when you install the patch.
CISA added CVE-2026-50522 to the Known Exploited Vulnerabilities catalog on July 22, with a federal remediation deadline of July 25 that has now passed. It is the fourth SharePoint vulnerability confirmed exploited in roughly a month.
If you run on-premises SharePoint, and it was reachable during the exposure window, patching is step one of six.
The Vulnerability
CVE-2026-50522 is a deserialization of untrusted data flaw (CWE-502) in on-premises SharePoint Server, rated CVSS 9.8. Microsoft shipped the fix on July 14 and credited DEVCORE researcher “splitline.” It was demonstrated at Pwn2Own Berlin, meaning Microsoft had a working exploit in hand before the patch shipped.
One thing to flag, because it affects triage. Microsoft’s advisory text describes an attacker “authenticated as at least a Site Owner.” That does not match the rest of the record. Microsoft’s own CVSS vector specifies no privileges and no user interaction, NVD describes an unauthorized attacker executing code over the network, and Defused reported the captured exploitation traffic carries no authentication material at all. The current analysis suggests the Site Owner requirement may be inaccurate or may have been carried over from the paired vulnerability, CVE-2026-58644.
Treat this as pre-authentication. If a “requires Site Owner” note has this sitting below something else in your queue, move it.
Six Days From Patch to Compromise
Patch ships
First detections
Public PoC — exploited within hours
Active exploitation confirmed
CISA adds to KEV
Defused’s earlier detections suggest exploitation may have started before the PoC dropped. Either way, the gap between public exploit and confirmed compromise was hours.
Why Machine Keys Change the Remediation Math
This is what separates CVE-2026-50522 from a routine critical patch.
SharePoint runs on ASP.NET inside IIS. The machine keys, ValidationKey and DecryptionKey in web.config, are what SharePoint uses to sign and encrypt ViewState, authentication tokens, and session data. They are the server’s proof that a token it receives is one it issued.
An attacker who steals those keys can forge that proof. They can craft valid __VIEWSTATE payloads and authentication tokens SharePoint accepts without question, impersonate any user, and reach any site or document with that identity’s privileges. watchTowr observed attackers pulling the keys via a single request.
Stolen keys do not expire when you patch.
The patch closes the deserialization path. It does not invalidate key material that already left the building. Until you rotate, an attacker with your keys has credential-less, persistent, legitimate-looking access to a server you believe you just remediated.
This is the same persistence mechanism from the ToolShell campaign last summer, which hit hundreds of organizations including five federal agencies. Same platform, same primitive, same mistake available to make twice.
This Is a Campaign, Not a Vulnerability
CVE-2026-50522 is the fourth SharePoint flaw confirmed exploited in about a month. The KEV cadence tells the story:
Four federal deadlines in three weeks on one product.
CVE-2026-56164 deserves a callout for anyone prioritizing by CVSS. It scores 5.3, which reads like a backlog item. It is an unauthenticated, zero-click, network-reachable path to Farm Administrator, found by Mandiant and Google FLARE responders during live attacks and exploited as a zero-day. A medium score on a pre-auth, actively weaponized flaw is a critical exposure in practice.
One more already in motion: CVE-2026-55040, a CVSS 9.1 authentication bypass found by Rapid7, is the first link in a chain whose second half is under embargo until August’s Patch Tuesday on August 11, roughly two weeks out. Together they reportedly enable unauthenticated RCE. Patch the first half now.
Shadowserver tracks roughly 10,000 internet-exposed SharePoint servers. Censys adds a detection wrinkle: for SharePoint 2019 and Subscription Edition, the fix changes only the revision and leaves the reported build unchanged, so you cannot confirm patch status from an HTTP header. External scanning will not answer this. You have to check the servers.
What To Do Now
Patch, then verify on the host.
Hunt before you rotate.
Rotate machine keys and restart IIS.
Rotate adjacent credentials.
Reduce the exposure.
If it was exposed and unpatched, treat it as an incident, not a ticket.
The Problem Underneath
SharePoint Server 2016 and 2019 reached end of extended support on July 14, 2026. That is the same day this patch shipped.
There is no Extended Security Update program for SharePoint at any price. Exchange got one. SharePoint did not. Subscription Edition is the only remaining supported on-premises option.
No ESU program exists
So July’s updates were the last ones those platforms will ever receive. CVE-2026-50522 got a fix because it landed on the final Patch Tuesday. Future vulnerabilities affecting unsupported versions will not receive the same level of security updates, and on this cadence there will be more. If you are still on 2016 or 2019, every future CVE is permanent.
Running unsupported server software also fails most compliance frameworks and increasingly complicates cyber insurance, which turns a deferred IT project into a finding on your next audit. If migration planning has been sitting in a backlog, this is the quarter it becomes a risk decision leadership formally owns with a documented timeline rather than an intention.
