CVE-2026-50522: SharePoint RCE Under Active Exploitation, CISA Orders Patches by July 25

Microsoft patched CVE-2026-50522, a critical deserialization vulnerability in on-premises SharePoint, on July 14. The bug carries a CVSS score of 9.8 and, as The Hacker News detailed, attackers can exploit it to steal the server’s machine keys with a single request. The machine key is the cryptographic secret that SharePoint uses to encrypt ViewState and sign authentication tickets; once an attacker has it, they can forge valid session tokens and maintain access even after the vulnerability itself is patched, unless administrators take the additional step of rotating the key.

For about a week, the patch stayed under the radar. Then, on July 21, security firm WatchTowr confirmed active exploitation in the wild, shortly after proof-of-concept exploit code was released. The PoC dramatically lowered the barrier for attackers, and within days of its appearance, incidents were detected attempting to harvest machine keys.

The following day, July 22, CISA added CVE-2026-50522 to its Known Exploited Vulnerabilities catalog, binding federal civilian agencies to a three-day patch deadline of July 25 — according to the same Hacker News report. The accelerated timeline is a blunt signal that the vulnerability is not just theoretically dangerous but being used right now to break into federal networks.

The theft of a SharePoint machine key is a particularly insidious prize. With it, an attacker can decrypt view state, forge legitimate authentication cookies, and persist inside an environment long after the initial entry point is closed. Rotating the key is essential after patching, but many organizations will apply the update and leave the old key in place, giving the attacker a permanent backdoor.

SecurityWeek’s reporting emphasized that this is the fourth SharePoint vulnerability actively exploited in the past month’s wave of attacks. SharePoint on-premises deployments remain a high-value target because they often sit at the intersection of internal collaboration and external access, holding sensitive documents and providing a pivot point into broader Active Directory environments.

The compressed timeline from patch to exploitation mirrors a pattern that has become routine for critical infrastructure software: public PoCs shorten the window for organizations to react, and CISA’s binding operational directives are designed to force the issue for those that might otherwise delay. With the fix available since July 14 and active attacks confirmed, the question is no longer whether organizations should apply it, but whether they also have a plan to rotate their machine keys before someone else does.

Sources

• Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC — The Hacker News
• Fourth SharePoint Vulnerability Exploited in Past Month’s Wave of Attacks — SecurityWeek