Microsoft’s July 2026 Patch Tuesday fix for SharePoint Server has turned into an active-exploitation emergency. CVE-2026-50522, a critical deserialization-of-untrusted-data vulnerability with a CVSS score of 9.8, is now being exploited in the wild against on-premises SharePoint deployments — and attackers aren’t just popping shells, they’re stealing cryptographic machine keys that survive the patch entirely.

What happened

Microsoft patched CVE-2026-50522 on July 14, 2026 as part of its 622-fix Patch Tuesday release. A public proof-of-concept exploit surfaced on July 20, and offensive security firm watchTowr detected real-world exploitation attempts within hours of the PoC going live. watchTowr has described the attack as having “ToolShell-class impact” — a direct reference to the summer 2025 SharePoint campaign in which ransomware crews and state-linked actors compromised hundreds of on-prem SharePoint customers using a chained deserialization/auth-bypass exploit. This is the third significant on-prem SharePoint RCE disclosed this year, following CVE-2026-45659 in May and CVE-2026-20963 in March — Microsoft’s SharePoint deserialization problem is a recurring pattern, not a one-off bug.

Technical details

The root cause sits in the SessionSecurityTokenHandler class, which fails to properly validate user-supplied data before deserializing it into .NET objects. As with prior SharePoint deserialization bugs, an attacker who can reach a vulnerable endpoint can smuggle a serialized payload that rehydrates into a gadget chain, leading to arbitrary code or assembly execution in the context of the SharePoint application pool account. Exploitation requires only Site Owner-level privileges per Microsoft’s advisory — not farm administrator access — which puts it in reach of any attacker who has phished or otherwise obtained a mid-tier SharePoint user’s credentials, or who can reach an internet-facing SharePoint front end.

Affected products are Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise — the on-premises product line, not SharePoint Online.

What makes this exploitation wave distinct from a routine RCE is the objective once code execution is achieved: attackers are extracting the farm’s machineKey values (the validationKey and decryptionKey used for ASP.NET view-state and forms-auth token signing/encryption). Anyone holding those keys can forge valid authentication tokens and impersonate any user or service account on the farm — including after the SharePoint binaries have been patched, since the stolen keys themselves aren’t rotated by the security update. This mirrors the persistence technique used in the 2025 ToolShell campaign, where machine-key theft let attackers walk back in weeks after victims believed they’d remediated.

Impact

Given the CVSS 9.8 severity, the low privilege bar, and active in-the-wild exploitation confirmed within hours of PoC release, any internet-reachable or otherwise exposed on-prem SharePoint farm running an unpatched version should be treated as likely compromised, not just vulnerable. Successful exploitation gives attackers: arbitrary code execution as the SharePoint service account, access to content databases and configuration secrets, farm and service account credential theft, and — via the stolen machine keys — a persistence mechanism that patching alone does not close. Organizations that were compromised before applying the July 14 patch remain exposed to forged-token access even now.

Mitigation

  • Apply Microsoft’s July 2026 Patch Tuesday SharePoint updates immediately if you haven’t already — CVE-2026-50522 is patched in that release.
  • Patching is necessary but not sufficient: rotate the SharePoint farm’s machineKey values (validationKey/decryptionKey) for every farm that was internet-reachable or otherwise exposed prior to patching, then perform an IIS reset across all front-end servers.
  • Review IIS and SharePoint ULS logs for anomalous requests to authentication/session-handling endpoints going back to at least July 20, and for any webshells or unexpected assemblies dropped in the SharePoint hive.
  • Treat any farm that shows signs of prior exploitation as fully compromised: rotate all service account credentials, and invalidate existing sessions/tokens after key rotation.
  • Where internet exposure isn’t required, take on-prem SharePoint front ends off the public internet and place them behind an authenticated reverse proxy or VPN.

Track Microsoft’s advisory and CISA’s Known Exploited Vulnerabilities catalog for confirmation of KEV addition, and monitor watchTowr and vendor incident-response guidance for IOCs as the campaign develops.