CVE-2026-50522 SharePoint KEV RCE: PoC Still Immature
Update log: Updated 2026-07-28: refreshed platform data and analysis.
Microsoft SharePoint contains a CVSS 9.8 Critical deserialization of untrusted data vulnerability tracked as CVE-2026-50522, which allows an unauthorized attacker to execute code over a network. The CISA Known Exploited Vulnerabilities catalog added this vulnerability on 2026-07-22. This confirms in-the-wild exploitation, and the federal remediation deadline of July 25, 2026, passed three days ago as of July 28. The flaw affects Microsoft Sharepoint Server Subscription Edition, Enterprise Edition 2016, and Server 2019, exposing the application process to total compromise without requiring prior authentication. During our threat tracking, our analysts triaged one public artifact out of three tracked samples for this vulnerability, assessing that immediate risk is low if used as intended in isolated labs, but rises if replaced with real exploit payloads.
Exposed Microsoft SharePoint Environments
The vulnerability exists in specific iterations of the Microsoft SharePoint environment. Administrators must immediately identify vulnerable instances. NVD configuration data lists the affected versions that administrators must evaluate and patch. The impacted ranges include:
- Microsoft Sharepoint Server Subscription Edition before 16.0.19725.20434
- Microsoft Sharepoint Server Enterprise Edition 2016
- Microsoft Sharepoint Server 2019
Deployments executing builds at or above the 16.0.19725.20434 fixed version are not affected by this vulnerability. Deployments lacking the vendor update suffer from an extreme risk profile, defined by the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This vector describes an attack reachable over the network, requiring no privileges to execute, requiring no user interaction from the victim, and operating with low attack complexity. Upon successful execution, the exploit leads to a complete loss of confidentiality, integrity, and availability for the compromised system.
Deserialization of Untrusted Data Execution Mechanism
CISA identifies CVE-2026-50522 as a Microsoft SharePoint Deserialization of Untrusted Data Vulnerability. The weakness class assigned to this issue is CWE-502, defined as the deserialization of untrusted data. The attack works by exploiting how Microsoft SharePoint service components handle inbound information structures. The application rebuilds an object graph from attacker-controlled bytes without restricting which types the system constructs during the data parsing sequence.
An unauthorized attacker sends a specially crafted payload over a network to the target server. The application component accepts the inbound stream and attempts to parse it. A gadget chain of types already present in the Microsoft SharePoint application then reaches a method that executes code. Because the application processes this stream natively, the payload runs inside the process that deserialized it. This grants the attacker immediate unauthorized code execution on the hosting infrastructure, using the Microsoft SharePoint service to run arbitrary code. The vendor description confirms this execution sequence allows complete network-based compromise. For related coverage, see Microsoft SharePoint CVE-2026-45659 (CVSS 8.8) RCE.
Detection Engineering and Threat Hunting Guidance
Our detection engineers maintain log sources for Microsoft SharePoint on IIS. Security operations teams must capture the IIS access logs generated by the SharePoint web application, located at %SystemDrive%\inetpub\logs\LogFiles. Analysts must filter this raw telemetry focusing on POST requests directed to the /_layouts/ and /_vti_bin/ endpoints.
Alongside the web access logs, teams must aggregate Windows Security event 4688 and Sysmon event 1 to capture all process creation activity on every single SharePoint server in the environment. Administrators need to pull Sysmon event 11, which records file creation operations, and strictly scope this collection to the SharePoint web directories found under the path C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions. Defenders must gather the proprietary SharePoint ULS logs to inspect them for recorded deserialization failures and ViewState validation errors.
We recommend executing the following hunt leads across the aggregated telemetry:
- Track instances of the
w3wp.exeexecutable spawningcmd.exe,powershell.exe,cscript.exe, orrundll32.exe: the IIS worker process has no reason to start a shell. - Identify newly written
.aspx,.asmx, or.ashxfiles under theLAYOUTSorwwwrootdirectories, which is where a web shell lands after code execution. - Search for outbound connections from a SharePoint server to an address that is not a Microsoft update or internal service endpoint.
- Locate IIS log entries with long or base64-heavy POST bodies to
/_layouts/paths, followed within seconds by a 200 response and a new process on the same host.
When a hunt lead hits, you must isolate the server from the network before rebuilding: a compromised SharePoint front end holds credentials for the farm service accounts. First, collect the IIS logs, the ULS logs, and a memory image before reboot, because a reboot destroys in-memory web-shell state. Rotate the farm machine keys and the service-account credentials after patching, since code execution on the front end exposes both. Review every .aspx, .asmx, and .ashx file in the web directories against a known-good deployment manifest before returning the server to service.
No indicators of compromise appear in the public reporting we collected, so defenders must utilize the behavioral hunt leads above instead.
To automate identification of post-exploitation commands, deploy the following Sigma rule as given. Tune the rule against false positives by allow-listing the specific deployment or monitoring scripts your application pool identity runs, filtering by full command line rather than by process name.
title: IIS Worker Process Spawning a Command Shell
id: 6f1d4b52-2f9f-4a7a-9d0e-3e2c0a5d7a11
status: experimental
description: Detects w3wp.exe starting an interpreter, the first post-exploitation step after code execution in a SharePoint or IIS web application.
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: '\w3wp.exe'
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\cscript.exe'
- '\wscript.exe'
- '\rundll32.exe'
condition: selection
falsepositives:
- Deployment or maintenance scripts run through the application pool identity
level: high
Examination of Public Exploit Artifacts
Our threat tracking reveals activity related to this vulnerability. We first tracked CVE-2026-50522 on July 15, and CISA KEV-listed it seven days later on July 22. Our intelligence records exploitation activity in the wild for this vulnerability, spanning across three tracked exploit artifacts. Our news tracking separately records six public news reports documenting that a working exploit is available for this vulnerability. We observe no chatter on actor-operated Telegram channels or breach forums in the last seven days, which tells us only that visible public discussion is absent, and does not guarantee safety from active attacks.
Our analysts examined one public artifact out of the three we track for this CVE. That triage scored it 75/100 in our triage, a figure that describes only the quality of the one public exploit artifact we examined and is not a measurement of exploitation. No functional exploit is provided in the PoC; the content is an educational scaffold. Immediate risk is low if used as intended in isolated labs, but rises if replaced with real exploit payloads. For related coverage, see Mirasvit CVE-2026-45247 Critical RCE Exploit.
Mandatory Remediation Directives
CISA dictates a required action for federal agencies managing these deployments: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's "Forensics Triage Requirements" (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders must follow these directives to eliminate the attack surface. CISA's KEV entry references a vendor advisory for this CVE, confirming remediation guidance is publicly available.
- Apply vendor mitigations to the affected versions immediately, because the federal remediation deadline passed three days ago.
- Rotate farm machine keys and service accounts post-patching, because our intelligence confirms three exploit artifacts exist in the wild for this critical vulnerability.
The required work follows a chronological execution order based on the expired deadline. Teams must implement the vendor instructions immediately across all builds. No asset should skip or defer patching since the vulnerability is confirmed exploited in the wild. Following the patch application, defenders perform the rotation of the farm machine keys and the service accounts. Administrators review the deployment manifest against all .aspx, .asmx, and .ashx files as the final step before removing network isolation and returning the server to full operational status.
Analysis produced by the Purple-Ops threat intelligence team from our own vulnerability triage and threat-intelligence tracking.
