2026-009: Critical Vulnerabilities in Microsoft SharePoint
WatchTowr observed active exploitation of SharePoint RCE CVE-2026-50522 (CVSS 9.8), part of an ongoing wave of exploited on-prem SharePoint flaws patched by Microsoft.
On 14 July 2026 Microsoft released updates for critical SharePoint Server RCE flaws, including CVE-2026-50522 (CVSS 9.8), a deserialisation vulnerability possibly exploitable without authentication. On 20 July 2026 WatchTowr published PoC exploit code and observed active exploitation of CVE-2026-50522, prompting CISA to urge SharePoint hardening. The advisory also covers recently fixed SharePoint flaws: CVE-2026-32201 (6.5, spoofing), CVE-2026-45659 (8.8, authenticated RCE), CVE-2026-56164 (9.8, unauthenticated privilege escalation), and CVE-2026-58644 (9.8, unauthenticated RCE). Affected products include SharePoint Server Subscription Edition, 2019, and Enterprise Server 2016; CERT-EU recommends immediate patching, credential rotation, and compromise assessments.
- CVE-2026-50522 (CVSS 9.8): SharePoint deserialisation RCE, possibly unauthenticated
- WatchTowr published PoC and observed active exploitation on 20 July 2026
- Additional 9.8-severity unauth RCEs fixed: CVE-2026-56164, CVE-2026-58644
- CISA urged SharePoint hardening; rotate credentials for exposed servers
- Affects SharePoint Subscription Edition, 2019, and Enterprise 2016
- Vendors
- Microsoft
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-32201 | Improper Input Validation Spoofing Vulnerability in Microsoft SharePoint Server | 6.5 | 43% | KEV | KEV |
| CVE-2026-45659 | Authenticated Deserialization RCE in Microsoft SharePoint Server (Actively Exploited) | 8.8 | 80% | KEVRansomware | KEV |
CVE-2026-58644+1 related CVE | Unauthenticated Deserialization RCE in Microsoft SharePoint Server | 9.8 | 16% | KEV | KEV |
| CVE-2026-56164 | Missing Authentication in Microsoft SharePoint Server Allows Privilege Escalation | 9.8 | 1% | KEV | KEV |
From the original article
2 min read at cert.europa.eu
[UPDATED] On 14 July 2026, Microsoft released security updates addressing critical remote code execution (RCE) vulnerabilities in Microsoft SharePoint Server.
cert.europa.eu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.