CVE-2026-50522 SharePoint KEV RCE: Public PoC Still Immature

Update log: Updated 2026-07-25: refreshed platform data and analysis.

CVE-2026-50522 is a CVSS 9.8 Critical vulnerability in Microsoft SharePoint. According to the NVD description, deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. CISA KEV names this the Microsoft SharePoint Deserialization of Untrusted Data Vulnerability. CISA added CVE-2026-50522 to the Known Exploited Vulnerabilities catalog, confirming in-the-wild exploitation is occurring. The federal remediation deadline is 2026-07-25. The vulnerability exposes the specific builds of Microsoft SharePoint Server detailed in the sections below. Our threat intelligence records exploitation activity in the wild for this vulnerability, tracking two exploit artifacts.

Vulnerability Mechanism: CWE-502 Deserialization of Untrusted Data

The assigned weakness class is CWE-502, Deserialization of untrusted data. The application rebuilds an object graph from attacker-controlled bytes without restricting which types are constructed. A gadget chain of types already present in the application then reaches a method that executes code, so the payload runs inside the process that deserialized it.

In Microsoft Office SharePoint, the attack targets the /_trust/default.aspx WS-Federation endpoint. An attacker generates a BinaryFormatter serialized payload using a tool like ysoserial utilizing the TypeConfuseDelegate gadget. The payload executes Invoke-WebRequest to an out-of-band callback URL. The raw bytes are deflated via zlib and Base64-encoded into a cookie value. The cookie is wrapped inside a SecurityContextToken XML structure. The token is then embedded in a RequestSecurityTokenResponse.

The attacker POSTs the wresult parameter containing this structure to the /_trust/default.aspx endpoint. Microsoft SharePoint deserializes the token. The application processes this data without verifying its safety, allowing the gadget chain to execute within the context of the IIS worker process. The payload triggers unauthenticated code execution running as the application pool identity. The attacker immediately gains the ability to execute operating system commands, which directly exposes any data handled by the web application and all credentials stored on the host. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H means: reachable over the network, no privileges required, no user interaction, low attack complexity, total loss of confidentiality, integrity, and availability.

Exposed SharePoint Server Versions

The NVD configuration data publishes the authoritative range of exposed versions so a reader checks their own estate. Defenders confirm their own build by reviewing the central administration panel or system patch logs against the NVD ranges. Builds at or above a fixed version are explicitly not affected by this deserialization vulnerability and do not require emergency action. The exposed products are:

  • Microsoft Sharepoint Server Subscription Edition before 16.0.19725.20434
  • Microsoft Sharepoint Server Enterprise Edition 2016
  • Microsoft Sharepoint Server 2019

Examination of the Public Exploit Artifact

We first tracked CVE-2026-50522, and CISA KEV-listed the vulnerability 7 days later. Our analysts triaged one public artifact out of the two we track for this CVE. That triage scored the artifact 75/100. The KEV listing confirms exploitation while our score describes only the quality of the one public artifact we examined, and that it is not a measurement of exploitation. No functional exploit is provided in the PoC; the content is an educational scaffold. Immediate risk is low if used as intended in isolated labs, but rises if replaced with real exploit payloads.

We recorded no chatter on actor-operated Telegram channels or breach forums in the last 7 days. Due to this absence of underground chatter, defenders rely on established behavioral tracking, not threat actor discussions. We separately record 5 public news reports for this vulnerability. No indicators of compromise appear in the public reporting we collected. Defenders implement the behavioral hunt leads detailed in the next section instead of searching for static hashes.

For related coverage, see Microsoft SharePoint CVE-2026-45659 (CVSS 8.8) RCE.

Detection Guidance and Behavioral Hunt Leads

We provide concrete defender guidance for Microsoft SharePoint on IIS tied to this vulnerability. Security teams collect specific log sources to monitor for CVE-2026-50522 exploitation. Retrieve the IIS access logs for the SharePoint web application (%SystemDrive%\inetpub\logs\LogFiles), filtered on POST requests to /_layouts/ and /_vti_bin/ endpoints. Collect Windows Security event 4688 and Sysmon event 1 (process creation) on every SharePoint server. Gather Sysmon event 11 (file create) scoped to the SharePoint web directories under C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions. Pull the SharePoint ULS logs for deserialization and ViewState validation errors.

Deploy the following behavioral hunt leads against the collected log sources: * Hunt for w3wp.exe spawning cmd.exe, powershell.exe, cscript.exe, or rundll32.exe: the IIS worker process has no reason to start a shell. A hit in the process creation events shows the web server parent process spawning a command interpreter. This is highly suspicious because it indicates the deserialized payload successfully initiated post-exploitation command execution. * Hunt for newly written .aspx, .asmx, or .ashx files under the LAYOUTS or wwwroot directories, which is where a web shell lands after code execution. A hit in the scoped file creation events reveals an unexpected executable web extension written to a sensitive path. This is suspicious because legitimate updates utilize structured deployment tools, whereas an unexpected file write is an attacker dropping persistent access tools. * Hunt for outbound connections from a SharePoint server to an address that is not a Microsoft update or internal service endpoint. A network log hit shows the front-end server initiating traffic to an unknown external IP address. This behavior is suspicious because a healthy SharePoint front end communicates only with known infrastructure, meaning any anomalous outbound connection implies an executing payload fetching secondary tools. * Hunt for IIS log entries with long or base64-heavy POST bodies to /_layouts/ paths, followed within seconds by a 200 response and a new process on the same host. A hit looks like an unusually large request in the web logs immediately preceding a process creation event.

If a hunt lead hits, execute the required response steps immediately: * Isolate the server from the network before rebuilding: a compromised SharePoint front end holds credentials for the farm service accounts. Severing network access stops the attacker from exfiltrating these credentials or pivoting deeper into the domain environment. * Collect the IIS logs, the ULS logs, and a memory image before reboot, because a reboot destroys in-memory web-shell state. Preserving this evidence guarantees incident responders analyze the exact payload and exploitation timeline. * Rotate the farm machine keys and the service-account credentials after patching, since code execution on the front end exposes both. Changing these secrets prevents an attacker from using stolen keys to forge new authentication tokens after the initial backdoor is removed. * Review every .aspx, .asmx, and .ashx file in the web directories against a known-good deployment manifest before returning the server to service. Verifying these files ensures no hidden web shells remain, preventing immediate re-compromise upon network reconnection.

Reproduce the following Sigma rule exactly as given to detect post-exploitation behavior. Tune the rule by allow-listing the specific deployment or monitoring scripts your application pool identity runs, by full command line rather than by process name. This false-positive tuning approach filters out legitimate maintenance tasks without blinding the rule to unexpected malicious commands.

title: IIS Worker Process Spawning a Command Shell
id: 6f1d4b52-2f9f-4a7a-9d0e-3e2c0a5d7a11
status: experimental
description: Detects w3wp.exe starting an interpreter, the first post-exploitation step after code execution in a SharePoint or IIS web application.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\w3wp.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\rundll32.exe'
  condition: selection
falsepositives:
  - Deployment or maintenance scripts run through the application pool identity
level: high

Remediation Directed by the Federal Deadline

The CISA required action for federal agencies mandates: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's "Forensics Triage Requirements" (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders find remediation guidance publicly available through the vendor advisory referenced in the KEV entry.

  • Apply vendor mitigations for the affected versions listed above before the deadline.
  • Monitor the documented IIS and SharePoint ULS log sources for behavioral hunt leads, because zero indicators of compromise appear in the public reporting.

Security teams follow a strict remediation ordering against the named deadline. First, administrators apply vendor mitigations to the exposed builds immediately to close the vulnerability before the 2026-07-25 cutoff. Patching takes precedence to eliminate the deserialization vector entirely. Second, teams operationalize the monitoring of the documented log sources to track the behavioral hunt leads within the next 24 hours. Continuous monitoring validates that no exploitation occurred prior to the patch application.

For related coverage, see CVE-2026-32201 SharePoint Spoofing: Urgent Fixes (CVSS Medium).

Analysis produced by the Purple-Ops threat intelligence team from our own vulnerability triage and threat-intelligence tracking.