2026-009: Critical Vulnerabilities in Microsoft SharePoint
WatchTowr observed active exploitation of SharePoint RCE CVE-2026-50522 (CVSS 9.8), part of an ongoing wave of exploited on-prem SharePoint flaws patched by Microsoft.
90
Product
SharePoint Enterprise Server 2016
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 8, 2026
- Last mentionedSep 8, 2026
Timeline
2 articles · newest first2026-004: Critical Vulnerability in SharePoint Exploited
CVE-2026-20963 (CVSS 9.8), an unauthenticated RCE in on-prem SharePoint, was added to CISA's KEV on 18 March 2026 and is actively exploited.
90
Related CVEs
by mentions- CVE-2026-2096329%9.8Deserialization RCE in Microsoft SharePoint Exploited in the Wild
- CVE-2026-561641%9.8Missing Authentication in Microsoft SharePoint Server Allows Privilege Escalation
- CVE-2026-5864416%9.8Unauthenticated Deserialization RCE in Microsoft SharePoint Server
- CVE-2026-505223%9.8Unauthenticated Deserialization RCE in Microsoft SharePoint Server
- CVE-2026-4565980%8.8Authenticated Deserialization RCE in Microsoft SharePoint Server (Actively Exploited)
- CVE-2026-3220143%6.5Improper Input Validation Spoofing Vulnerability in Microsoft SharePoint Server
- CVE-2026-261061%8.8Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network
- CVE-2026-261143%8.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network
- CVE-2026-26113<1%7.8Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally
Appears with
- SharePoint Server Subscription Editionproduct · 2
- Microsoftvendor · 2
- CERT-EUorganization · 2
- SharePoint Serverproduct · 2
- CISAorganization · 2
- Microsoftorganization · 1
- WatchTowrorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.