ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “cve-2026-50522”

16 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 8Exploit / PoC 5Ransomware 2Data breach 1Industry 1
SeverityAllcritical 15high 1medium 1low 0info 0

CVE-2026-50522: Patch Critical SharePoint RCE Now

Microsoft patched CVE-2026-50522 (CVSS 9.8), an unauthenticated deserialization RCE in on-premises SharePoint servers, in its July 2026 updates; no exploitation confirmed at disclosure.

CVE-2026-50522 is a critical (CVSS 9.8) deserialization of untrusted data flaw (CWE-502) allowing unauthenticated remote code execution on on-premises Microsoft SharePoint servers. It affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, with fixes shipped in Microsoft's July 14, 2026 security updates; SharePoint Online is not listed as affected. No public evidence of active exploitation of this specific CVE existed at disclosure, though CISA's SSVC judged the attack automatable with total technical impact.

Web discovery (articles for new exploits & KEV entries) · 8d agoVulnerabilityCVE-2026-50522

2026-009: Critical Vulnerabilities in Microsoft SharePoint

WatchTowr observed active exploitation of SharePoint RCE CVE-2026-50522 (CVSS 9.8), part of an ongoing wave of exploited on-prem SharePoint flaws patched by Microsoft.

On 14 July 2026 Microsoft released updates for critical SharePoint Server RCE flaws, including CVE-2026-50522 (CVSS 9.8), a deserialisation vulnerability possibly exploitable without authentication. On 20 July 2026 WatchTowr published PoC exploit code and observed active exploitation of CVE-2026-50522, prompting CISA to urge SharePoint hardening. The advisory also covers recently fixed SharePoint flaws: CVE-2026-32201 (6.5, spoofing), CVE-2026-45659 (8.8, authenticated RCE), CVE-2026-56164 (9.8, unauthenticated privilege escalation), and CVE-2026-58644 (9.8, unauthenticated RCE). Affected products include SharePoint Server Subscription Edition, 2019, and Enterprise Server 2016; CERT-EU recommends immediate patching, credential rotation, and compromise assessments.

CERT-EU Advisoriesupdated · 9d agofirst · Jul 22, 2026Exploit / PoC in the wild 3 sourcesCVE-2026-50522CVE-2026-32201CVE-2026-45659+2 CVEs

August 2026 Patch Tuesday forecast: How do we deal with the patch apocalypse?

August 2026 Patch Tuesday forecast urges risk-based triage as AI inflates CVE volume, flags actively exploited SharePoint RCE CVE-2026-50522 and LegacyHive Windows flaw.

July 2026 Patch Tuesday set records with over 600 CVEs, including 405 for Windows 11 and Server 2025, though only two were exploited zero-days and one was publicly disclosed. The author recommends prioritizing known-exploited and internet-facing vulnerabilities, matching patches to high-risk systems, and accelerating ring-based deployment toward Microsoft's suggested three-day turnaround. Notable items include actively exploited SharePoint RCE CVE-2026-50522 enabling machine key theft, the unassigned LegacyHive Windows User Profile Service flaw, and several end-of-servicing dates for Windows and Exchange.

Help Net Security · 22d agoIndustry in the wildCVE-2026-505221

Attackers Exploit SharePoint Authentication Bypass After Public PoC Release

Attackers exploit SharePoint authentication bypass CVE-2026-55040 (CVSS 9.1) after Rapid7's PoC release, with 12 exploitation attempts recorded since July 19, 2026.

Microsoft patched CVE-2026-55040 in its July 2026 Patch Tuesday; the 9.1-severity flaw chains four weaknesses in SharePoint's JWT token validation pipeline, letting unauthenticated attackers forge valid JWTs and impersonate any SharePoint site user or administrator. Threat actors began exploiting the bug after Rapid7 released a Python PoC that forges tokens and enumerates domain users by SID. KEVIntel telemetry shows 12 exploitation attempts since July 19, 2026, eight of them on August 12-13 following the PoC release, originating from eight IPs across Hong Kong, Japan, the Netherlands, Taiwan, and the U.S. This is the fifth SharePoint vulnerability exploited this year, alongside CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522.

The Hacker News · Aug 15, 2026Exploit / PoC in the wildCVE-2026-55040CVE-2026-45659CVE-2026-56164+2 CVEs