VulnHub

Real-time Cybersecurity News

Critical

Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC

The Hacker News
Actively Exploited
3 Sources
Reporting on this topic
The Hacker NewsSecurity AffairsHelp Net Security
CVEMicrosoftVulnerabilityPatchUpdateRCECritical

Overview

A serious vulnerability in Microsoft SharePoint Server, identified as CVE-2026-50522, is currently being exploited in the wild. This flaw, which has a CVSS score of 9.8, allows attackers to execute arbitrary code on affected systems through deserialization of untrusted data. The vulnerability was patched by Microsoft during its July 2026 Patch Tuesday update but has since been targeted by malicious actors. Organizations using SharePoint need to prioritize applying the latest security updates to protect against potential unauthorized access and exploitation. It's crucial for administrators to stay vigilant and monitor their systems for any signs of compromise.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Microsoft Office SharePoint Server
  • Action Required: Organizations should apply the security patches provided by Microsoft in the July 2026 Patch Tuesday update to mitigate this vulnerability.
  • Timeline: Disclosed on July 2026

Original Article Summary

A third SharePoint Server flaw patched by Microsoft as part of its Patch Tuesday update for July 2026 has come under active exploitation, per watchTowr. The vulnerability in question is CVE-2026-50522 (CVSS score: 9.8), a critical deserialization of untrusted data in Microsoft Office SharePoint that could allow an unauthorized attacker to execute code over a network. Microsoft credited DEVCORE

Impact

Microsoft Office SharePoint Server

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Disclosed on July 2026

Remediation

Organizations should apply the security patches provided by Microsoft in the July 2026 Patch Tuesday update to mitigate this vulnerability.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Microsoft, Vulnerability, and 4 more.

Multiple Sources: This threat is being reported by 3 different security sources, indicating significant concern within the cybersecurity community.

Read Original Article

Related Coverage

Another SharePoint RCE exploited: Patch, then rotate your machine keys (CVE-2026-50522)

Help Net Security

Attackers are actively exploiting a serious remote code execution vulnerability in Microsoft SharePoint, identified as CVE-2026-50522. This vulnerability allows them to extract the IIS machine keys from on-premise SharePoint servers, enabling long-term access to the compromised systems. Following the release of public exploit code, researchers from WatchTowr reported successful attacks occurring just hours later. Companies using on-premise SharePoint installations need to be particularly vigilant, as the stolen machine keys can facilitate ongoing unauthorized access. It's crucial for organizations to patch this vulnerability promptly and take additional measures to secure their machine keys to prevent future exploitation.

Jul 22, 2026

Public PoC triggers active exploitation of critical SharePoint RCE vulnerability CVE-2026-50522

Security Affairs

A serious remote code execution (RCE) vulnerability in Microsoft SharePoint, identified as CVE-2026-50522, is currently being exploited by attackers. This vulnerability has a CVSS score of 9.8, indicating its severity. It was patched during Microsoft's July 2026 Patch Tuesday, but following the release of public proof-of-concept (PoC) exploit code, researchers from watchTowr have observed active exploitation in the wild. Organizations using SharePoint need to ensure they have applied the latest updates to protect against potential breaches. The situation underscores the urgency for companies to stay current on security patches to mitigate risks associated with known vulnerabilities.

Jul 21, 2026