Critical on-prem SharePoint deserialization RCE CVE-2026-50522 (CVSS 9.8) patched; WatchTowr reports active exploitation and CISA urges hardening

Microsoft patched CVE-2026-50522 (CVSS 9.8, CWE-502), an unauthenticated .NET deserialization RCE in on-premises SharePoint Server Subscription Edition, 2019, and Enterprise 2016, in its 14 July 2026 security updates; on 20 July 2026 WatchTowr published PoC…

Microsoft fixed CVE-2026-50522, a critical (CVSS 9.8) deserialization of untrusted data flaw (CWE-502) enabling remote code execution on on-premises Microsoft SharePoint servers, in its 14 July 2026 security updates. Affected products are SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016; SharePoint Online is not listed as affected. Two web reports describe the bug as exploitable by unauthenticated attackers who send crafted serialized .NET payloads to network-accessible SharePoint endpoints, triggering gadget-chain deserialization and code execution under the privileged SharePoint service account; CERT-EU hedges, calling it 'possibly' exploitable without authentication. Exploitation status evolved: at the 14 July disclosure no active exploitation of this specific CVE had been confirmed, and CISA's SSVC rated exploitation 'none' while judging the attack automatable with total technical impact; on 20 July 2026 WatchTowr published PoC exploit code and reported observing active exploitation, prompting CISA to urge SharePoint hardening. The sources disagree on PoC availability: the 7 September 2026 web report states no public PoC existed and the flaw was not in CISA's KEV catalog at its publication, while CERT-EU's 22 July advisory cites the 20 July WatchTowr PoC; no merged report lists CVE-2026-50522 as added to KEV. The reported EPSS score is 20.346%. The same July cycle also fixed CVE-2026-32201 (CVSS 6.5, spoofing), CVE-2026-45659 (8.8, authenticated RCE), CVE-2026-56164 (9.8, unauthenticated privilege escalation), and CVE-2026-58644 (9.8, unauthenticated RCE); CERT-EU describes this as part of an ongoing wave of exploited on-prem SharePoint flaws. A separate CERT-EU advisory covers the earlier March 2026 wave: CVE-2026-20963 (CVSS 9.8, unauthenticated RCE via deserialization of untrusted data affecting the same SharePoint versions), which Microsoft raised in severity on 17 March 2026 and which entered CISA's Known Exploited Vulnerabilities catalog on 18 March 2026, plus RCEs CVE-2026-26106, CVE-2026-26113, and CVE-2026-26114 fixed in the March 2026 release. If exploited, CVE-2026-50522 enables web shells, credential theft, and lateral movement into Microsoft 365 and Active Directory. Suggested detection: w3wp.exe spawning cmd.exe, powershell.exe, or certutil.exe; new .aspx files in layouts directories; encoded POST payloads. Recommended mitigations across the reports: apply Microsoft's updates promptly,…