Reported by 2 outlets

Timeline

1. original reporting

   CVE-2026-50522 — New SharePoint RCE Actively Exploited to Steal Machine Keys

   bleepingcomputer.com · 84d ago · July 22nd, 2026

   Previously covered July 17-21 (SharePoint exploitation cluster, CVE-2026-58644). New: A different SharePoint CVE — CVE-2026-50522 — now being exploited for machine key theft.

   A critical unauthenticated RCE vulnerability in Microsoft SharePoint (CVE-2026-50522, deserialization-of-untrusted-data) is under active exploitation. watchTowr confirmed that within hours of a public PoC becoming available on July 20, their global honeypot network captured exploitation attempts that successfully stole machine keys from vulnerable on-premise SharePoint servers.

   Attackers obtaining machine keys can create valid authentication tokens to impersonate any user and access SharePoint sites and documents indefinitely — even after the server is patched. Microsoft patched the flaw in the July 2026 Patch Tuesday but did not mark it as actively exploited at the time.

   This is separate from the previously tracked CVE-2026-58644 (the deserialization RCE in the earlier exploitation cluster). Together, they represent a two-front attack on on-premise SharePoint deployments.

   Action: Immediately patch CVE-2026-50522. After patching, rotate machine keys on any server that was internet-exposed prior to patching. Hunt for unauthorized authentication tokens.

   ---

2. update from securityweek.com

   CVE-2026-50522 — Fourth SharePoint Vulnerability Exploited Within a Month; Machine Key Theft Ongoing

   securityweek.com · 83d ago · July 23rd, 2026

   New: SecurityWeek frames this as the fourth SharePont vulnerability exploited this month — now part of a sustained exploitation cluster.*

   The active exploitation of CVE-2026-50522 — a critical deserialization RCE in on-premise Microsoft SharePoint Server — continues to generate incident response activity. SecurityWeek now counts this as the fourth SharePont vulnerability exploited in the past month's wave of attacks, alongside CVE-2026-58644, CVE-2026-56164, and CVE-2026-45659. Defused honeypots observed exploitation attempts beginning around July 17 targeting what appeared to be a zero-day, later confirmed as CVE-2026-50522. After public PoC was released, watchTowr confirmed attackers are stealing machine keys to retain long-term access beyond the patch window. Microsoft has not yet updated its advisory to reflect active exploitation. CVE-2026-50522 is not yet on CISA KEV (as of July 22), unlike CVE-2026-58644 which was added July 16.