CVE-2026-50522: Microsoft SharePoint Server RCE Vulnerability
Found by web discovery while looking for coverage of CVE-2026-50522
CVE-2026-50522 is an unauthenticated .NET deserialization RCE in SharePoint Server Subscription, 2019, and 2016; Microsoft patched it July 14, 2026.
CVE-2026-50522 (CWE-502) lets unauthenticated attackers send crafted serialized .NET payloads to network-accessible SharePoint endpoints, triggering gadget-chain deserialization and remote code execution under the privileged SharePoint service account. It affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise; Microsoft published the advisory on July 14, 2026. The EPSS score is 20.346%, but no public PoC exists and the flaw is not in CISA's KEV catalog at publication. Mitigations include applying Microsoft updates, rotating SharePoint machine keys, enabling AMSI, and restricting internet exposure.
- Exploitation enables web shells, credential theft, and lateral movement into Microsoft 365 and Active Directory.
- Detection: w3wp.exe spawning cmd.exe/powershell.exe/certutil.exe, new .aspx files in layouts directories, encoded POST payloads.
- Workarounds include AMSI integration in SharePoint 2016/2019 and reverse-proxy or VPN-based exposure restriction.
- CVEs
- CVE-2026-50522
- Vendors
- MicrosoftSentinelOneCISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-50522 | Unauthenticated Deserialization RCE in Microsoft SharePoint Server | 9.8 | 3% | KEV | KEV |
From the original article
4 min read at sentinelone.com
CVE-2026-50522 is a remote code execution vulnerability in Microsoft SharePoint Server. Learn about its impact, affected versions, and mitigation methods.
sentinelone.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.