VulnHub

Real-time Cybersecurity News

Critical

Public PoC triggers active exploitation of critical SharePoint RCE vulnerability CVE-2026-50522

Security Affairs
Actively Exploited
3 Sources
Reporting on this topic
The Hacker NewsSecurity AffairsHelp Net Security
CVEMicrosoftExploitVulnerabilityPatchRCECritical

Overview

A serious remote code execution (RCE) vulnerability in Microsoft SharePoint, identified as CVE-2026-50522, is currently being exploited by attackers. This vulnerability has a CVSS score of 9.8, indicating its severity. It was patched during Microsoft's July 2026 Patch Tuesday, but following the release of public proof-of-concept (PoC) exploit code, researchers from watchTowr have observed active exploitation in the wild. Organizations using SharePoint need to ensure they have applied the latest updates to protect against potential breaches. The situation underscores the urgency for companies to stay current on security patches to mitigate risks associated with known vulnerabilities.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Microsoft SharePoint (specific versions not mentioned)
  • Action Required: Apply the patch released in July 2026 Patch Tuesday for CVE-2026-50522.
  • Timeline: Disclosed on July 2026

Original Article Summary

Critical SharePoint RCE vulnerability CVE-2026-50522 is under active exploitation after the release of a PoC exploit code. A critical Microsoft SharePoint vulnerability, tracked as CVE-2026-50522 (CVSS score of 9.8), is being actively exploited following the release of a public proof-of-concept (PoC) code, according to watchTowr researchers. Patched in Microsoft’s July 2026 Patch Tuesday, the deserialization […]

Impact

Microsoft SharePoint (specific versions not mentioned)

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Disclosed on July 2026

Remediation

Apply the patch released in July 2026 Patch Tuesday for CVE-2026-50522.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Microsoft, Exploit, and 4 more.

Multiple Sources: This threat is being reported by 3 different security sources, indicating significant concern within the cybersecurity community.

Read Original Article

Related Coverage

Another SharePoint RCE exploited: Patch, then rotate your machine keys (CVE-2026-50522)

Help Net Security

Attackers are actively exploiting a serious remote code execution vulnerability in Microsoft SharePoint, identified as CVE-2026-50522. This vulnerability allows them to extract the IIS machine keys from on-premise SharePoint servers, enabling long-term access to the compromised systems. Following the release of public exploit code, researchers from WatchTowr reported successful attacks occurring just hours later. Companies using on-premise SharePoint installations need to be particularly vigilant, as the stolen machine keys can facilitate ongoing unauthorized access. It's crucial for organizations to patch this vulnerability promptly and take additional measures to secure their machine keys to prevent future exploitation.

Jul 22, 2026

Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC

The Hacker News

A serious vulnerability in Microsoft SharePoint Server, identified as CVE-2026-50522, is currently being exploited in the wild. This flaw, which has a CVSS score of 9.8, allows attackers to execute arbitrary code on affected systems through deserialization of untrusted data. The vulnerability was patched by Microsoft during its July 2026 Patch Tuesday update but has since been targeted by malicious actors. Organizations using SharePoint need to prioritize applying the latest security updates to protect against potential unauthorized access and exploitation. It's crucial for administrators to stay vigilant and monitor their systems for any signs of compromise.

Jul 21, 2026