Multiple Microsoft SharePoint Server vulnerabilities actively exploited, including critical CVE-2026-50522
Executive Summary
Several vulnerabilities addressed by Microsoft in its latest monthly patch release are now being actively exploited in the wild, including the critical SharePoint flaw CVE-2026-50522. Publicly available exploit code for this flaw has almost certainly enabled a broad range of threat actors to target SharePoint Server instances. In addition, multiple other vulnerabilities affecting SharePoint are also being actively exploited.
It is strongly recommended to apply the security updates or workarounds provided by Microsoft as soon as possible.
The threat level of this advisory is being raised to 4 out of 5.
What It Means
The critical vulnerability CVE-2026-50522 affecting Microsoft SharePoint Server on-premise is being actively exploited by threat actors, according to DefusedCyberand WatchTowr. It involves an unsafe deserialization issue that allows a remote attacker to execute arbitrary code on a SharePoint server.
Furthermore, contrary to previous reports, ZDI has stated that authentication is not required to exploit this vulnerability. Attacks started shortly after the release of a public PoC, attempting to compromise vulnerable servers by retrieving machine keys required for long-term persistence. DefusedCyber also detailed exploitation attempts leveraging a .NET deserialization vector targeting a SharePoint authentication endpoint. The observed requests did not require authentication, consistent with ZDI’s unauthenticated exploitation scenario.
The publicly released PoC abuses an exploitation chain based on sending a malicious .NET object containing a BinaryFormatter payload embedded within a forged SecurityContextToken. This object is delivered through a WS-Federation sign-in response sent to the SharePoint endpoint /_trust/default.aspx. When the vulnerable server processes this content and performs the deserialization operation, the payload can trigger remote arbitrary code execution.
Attackers are exploiting this vulnerability to retrieve ASP.NET machine keys from SharePoint IIS servers, used to generate valid authentication tokens. Once these keys are obtained, an attacker can impersonate legitimate users, access SharePoint sites, documents, and resources available to the forged identity. This also enables persistent access, including after the security patch has been applied.
CISA has also reported that other vulnerabilities affecting SharePoint Server, including CVE-2026-32201, CVE-2026-45659, and CVE-2026-58644, are being actively exploited.
- CVE-2026-32201 is an improper input validation vulnerability in Microsoft Office SharePoint that allows an unauthenticated remote attacker to impersonate an individual on a network to access or modify unauthorized data.
- CVE-2026-45659 is a vulnerability that allows a remote attacker authenticated as a site member to execute arbitrary code through unspecified vectors.
- CVE-2026-58644 is a vulnerability that allows a remote attacker with at least site owner privileges to execute arbitrary code on the SharePoint server through unspecified vectors.
- CVE-2026-56164 is a missing authentication issue that could be exploited via unspecified vectors to elevate privileges.
The previous Patch Tuesday release also includes additional SharePoint flaws that have not been confirmed as exploited at present.
What You Should Do
- We advise you to apply the security patches or workarounds released by Microsoft as soon as possible. Illustrating the gravity of this vulnerability, CISA has given U.S. federal agencies only three days to mitigate the risks associated with these SharePoint vulnerabilities.
- Applying the security patch alone is not sufficient in cases where prior exposure may have occurred. It is recommended to investigate the affected servers, rotate potentially compromised secrets, particularly machine keys and associated credentials, and search for potential indicators of compromise in SharePoint, IIS, and system logs.
