CVE-2026-50522

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-50522 9.8

Microsoft · SharePoint · Added 2026-07-22 · Published 2026-07-14

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityMicrosoft SharePoint Deserialization of Untrusted Data Vulnerability

VendorMicrosoft

ProductSharePoint

Date added2026-07-22

Due date2026-07-25

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-502

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.

NVD: Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-25 21:14 UTC

Searches2

Component defaultunknown

Sources https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522
https://thehackernews.com/2026/07/critical-sharepoint-rce-cve-2026-50522.html
https://www.bleepingcomputer.com/news/security/critical-sharepoint-rce-flaw-exploited-to-steal-machine-keys/
https://vulert.com/blog/sharepoint-cve-2026-50522-active-exploitation/
https://github.com/HORKimhab/CVE-2026-50522
https://github.com/4minx/CVE-2026-50522
https://github.com/WismanSec/sharepoint-2026-poc
https://github.com/darses/CVE-2026-50522
https://github.com/ChPratik/CVE-2026-50522
https://cvefeed.io/vuln/detail/CVE-2026-50522
https://www.cisa.gov/news-events/alerts/2026/07/22/cisa-adds-two-known-exploited-vulnerabilities-catalog
https://socradar.io/blog/cve-2026-50522-poc-fuels-sharepoint-attacks/
https://nguard.com/sa-sharepoint-cve-2026-50522/

QC notes

warn component_extraction: Component 'SharePoint WS-Federation trust endpoint (/_trust/default.aspx) — BinaryFormatter deserialization of SecurityContextToken cookie' matches or contains product name 'SharePoint' — no specific component identified

Hunting hypothesis agent

Hunt for unauthenticated POSTs to /_trust/default.aspx with SecurityContextToken XML in the wresult parameter, then check for Invoke-WebRequest callbacks from SharePoint IIS worker processes and machine key access indicators.

Research details

ComponentSharePoint WS-Federation trust endpoint (/_trust/default.aspx) — BinaryFormatter deserialization of SecurityContextToken cookie

PreconditionsNetwork reachability to an on-premises SharePoint Server; no authentication required; affects SharePoint Server Subscription Edition (before 16.0.19725.20434), SharePoint Server 2019 (before 16.0.10417.20175), and SharePoint Enterprise Server 2016 (before 16.0.5561.1001); the WS-Federation endpoint (/_trust/default.aspx) must be accessible. agent

DeliveryHTTP POST to /_trust/default.aspx with wresult parameter containing Base64-encoded BinaryFormatter payload in SecurityContextToken XML (TypeConfuseDelegate gadget chain via ysoserial.net)

Public PoCyes

PoC URLs https://github.com/HORKimhab/CVE-2026-50522
https://github.com/4minx/CVE-2026-50522
https://github.com/WismanSec/sharepoint-2026-poc
https://github.com/darses/CVE-2026-50522
https://github.com/ChPratik/CVE-2026-50522 Third-party repos; verify before use.

Advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522

Exploit notesMultiple public PoCs available (at least 5 repos). The exploit uses ysoserial.net TypeConfuseDelegate gadget to generate a BinaryFormatter serialized payload containing PowerShell Invoke-WebRequest for OOB callback. The payload is deflate-compressed and Base64-encoded, then embedded in a SecurityContextToken cookie within RequestSecurityTokenResponse XML. A POST to /_trust/default.aspx triggers SharePoint's BinaryFormatter.Deserialize, executing the payload in the IIS worker process (w3wp.exe) context. Attackers observed stealing IIS machine keys for persistence that survives patching. watchTowr confirmed active exploitation within hours of PoC publication. CVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0).

SummaryMicrosoft SharePoint Server (Subscription Edition, 2019, 2016) contains a deserialization of untrusted data vulnerability (CWE-502) enabling unauthenticated remote code execution via the WS-Federation trust endpoint (/_trust/default.aspx). Attackers use ysoserial.net TypeConfuseDelegate gadget to craft a BinaryFormatter payload, Base64-encode it in a SecurityContextToken cookie, and POST it to the endpoint, executing code as the IIS worker process. Multiple public PoCs published July 20-21, 2026; active exploitation observed within hours, with attackers stealing IIS machine keys for persistent access that survives patching. CVSS 9.8 CRITICAL; patched in July 2026 Patch Tuesday; CISA added to KEV July 22 with a July 25 deadline.

Tia coverage

First reported2026-07-22

First exploit report2026-07-22

Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cve-2026-50522-new-sharepoint-rce-actively-exploited-to-steal-ma swiss-government-sharepoint-breach-compromises-200-accounts warlock-ransomware-breach-sharepoint-in-water-telecom-operator-a

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.