CVE-2026-50522: Microsoft SharePoint Server RCE Vulnerability

CVE-2026-50522 Overview

CVE-2026-50522 is a deserialization of untrusted data vulnerability [CWE-502] affecting Microsoft SharePoint Server. An unauthenticated attacker can send crafted serialized payloads over the network to trigger unsafe object deserialization. Successful exploitation results in remote code execution in the context of the SharePoint service account.

The flaw affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise. No user interaction or prior authentication is required to reach the vulnerable code path. Microsoft published the advisory on July 14, 2026.

Critical Impact

Unauthenticated remote code execution on internet-facing SharePoint servers, enabling full compromise of collaboration infrastructure, credential theft, and lateral movement into connected Microsoft 365 and Active Directory environments.

Affected Products

• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

• 2026-07-14 - CVE-2026-50522 published to NVD and Microsoft Security Response Center advisory released
• 2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-50522

Vulnerability Analysis

The vulnerability resides in SharePoint Server's handling of serialized .NET objects received through network-accessible endpoints. SharePoint processes incoming data streams and reconstructs .NET objects without validating the type or contents of the serialized payload. This unsafe deserialization allows attacker-controlled gadget chains to execute arbitrary code during object reconstruction.

Because SharePoint typically runs under a privileged application pool identity, code executes with elevated rights on the underlying Windows server. The attack requires no authentication and no user interaction, and can be launched remotely against exposed SharePoint web front-ends. The EPSS score of 20.346% (97.2 percentile) reflects a high likelihood of exploitation activity.

Root Cause

The root cause is improper handling of untrusted serialized data, classified under CWE-502. SharePoint deserializes objects from network input without enforcing a type allowlist or integrity validation. Attackers can supply gadget chains that invoke dangerous methods during deserialization, converting object reconstruction into arbitrary code execution.

Attack Vector

An unauthenticated remote attacker sends a specially crafted HTTP request containing a malicious serialized payload to a vulnerable SharePoint endpoint. The server deserializes the payload and executes the embedded gadget chain, running attacker-supplied code in the context of the SharePoint worker process. From this foothold, attackers can extract machine keys, dump credentials, deploy web shells, and pivot deeper into the environment.

No public proof-of-concept has been released and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of publication. Refer to the Microsoft Vulnerability Update CVE-2026-50522 advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-50522

Indicators of Compromise

• Unusual w3wp.exe child processes spawning cmd.exe, powershell.exe, or certutil.exe on SharePoint servers
• New or modified .aspx files written to SharePoint layouts directories such as C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS
• Outbound network connections from SharePoint application pool identities to unknown external hosts
• HTTP POST requests containing base64-encoded serialized .NET payloads targeting SharePoint endpoints

Detection Strategies

• Monitor IIS logs for anomalous POST requests to SharePoint handler paths with large or encoded request bodies
• Alert on process creation events where w3wp.exe is the parent of scripting or living-off-the-land binaries
• Inspect SharePoint ULS logs for deserialization exceptions and unexpected type resolution errors
• Deploy YARA rules targeting known .NET deserialization gadget classes such as TypeConfuseDelegate and ObjectDataProvider

Monitoring Recommendations

• Enable Windows command-line auditing (Event ID 4688) and PowerShell script block logging on all SharePoint servers
• Forward IIS, ULS, and Windows Security logs to a centralized SIEM for correlation across the SharePoint farm
• Baseline normal SharePoint child process activity and alert on deviations
• Continuously monitor filesystem changes in SharePoint content and layout directories for unauthorized web shell drops

How to Mitigate CVE-2026-50522

Immediate Actions Required

• Apply the Microsoft security updates for SharePoint Server Subscription Edition, 2019, and 2016 immediately
• Rotate SharePoint machine keys after patching to invalidate any previously stolen ValidationKey or DecryptionKey material
• Restrict internet exposure of SharePoint front-ends and place them behind an authenticating reverse proxy or VPN
• Hunt for signs of prior exploitation, including unauthorized .aspx files and suspicious w3wp.exe child processes

Patch Information

Microsoft has released security updates addressing CVE-2026-50522. Administrators should consult the Microsoft Vulnerability Update CVE-2026-50522 advisory for the specific KB articles and cumulative update packages applicable to each SharePoint Server version. Apply updates through Windows Update, WSUS, or by manually installing the SharePoint cumulative update package on each server in the farm.

Workarounds

• Enable the Antimalware Scan Interface (AMSI) integration in SharePoint Server 2016 and 2019 to intercept malicious payloads
• Deploy Microsoft Defender Antivirus or an equivalent endpoint protection product on all SharePoint servers
• Restrict inbound access to SharePoint endpoints using web application firewall rules that inspect for serialized .NET payload patterns
• Isolate SharePoint servers on segmented network zones to limit lateral movement if compromise occurs

# Rotate SharePoint machine keys after patching (PowerShell on SharePoint server)
Set-SPMachineKey -WebApplication https://sharepoint.example.com
Update-SPMachineKey -WebApplication https://sharepoint.example.com
iisreset /noforce