~/f4n6 $ grep -r "CVE-2026-50522 — Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability" ./investigations/ --include="*.md"

CVE-2026-50522 — Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Jeff Davies 23 Jul 2026 5 min read

1. Executive summary

CVE-2026-50522 is a critical (CVSS 9.8) deserialization of untrusted data vulnerability in Microsoft Office SharePoint that permits an unauthenticated, remote attacker to execute arbitrary code over a network. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalogue on 2026-07-22 following confirmation of active exploitation and the public release of a proof-of-concept (PoC). EMEA financial services running internet-exposed SharePoint Server instances face immediate risk of unauthenticated remote code execution, which can lead to full system compromise, data exfiltration, and operational disruption. The CISA KEV remediation due date is 2026-07-25.

2. Regulatory framing

Article Trigger (the fact in this item) Practical impact
DORA Art. 19 — reporting of major ICT-related incidents to competent authorities Active exploitation of a CVSS 9.8 unauthenticated RCE on internet-facing SharePoint, CISA KEV-listed with a 2026-07-25 due date, creates a credible scenario for a major ICT-related incident if exploited in a client environment. Clients must be prepared to classify and report an incident under DORA Art. 19 if exploitation is confirmed on an in-scope asset, triggering the prescribed timelines for initial and follow-up reporting.
DORA Art. 24 — digital operational resilience testing — general requirements The vulnerability is automatable, unauthenticated, and has a public PoC, meaning standard vulnerability scanning and patch validation must be accelerated for SharePoint assets. Clients should prioritise immediate vulnerability detection and patch verification across all SharePoint estates as part of their operational resilience testing programme.

3. Technical analysis & attack chain

Vulnerability mechanism: CWE-502 — Deserialization of Untrusted Data. The flaw exists in Microsoft Office SharePoint's handling of serialized data submitted over the network. An attacker can supply a crafted serialized payload that SharePoint deserialises without sufficient validation, resulting in arbitrary code execution in the context of the SharePoint application pool (typically a high-privilege service account). The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, confirming network-accessible, low-complexity, unauthenticated exploitation with full confidentiality, integrity, and availability impact.

Confirmed attack chain

  1. Reconnaissance: Attacker identifies an internet-exposed Microsoft Office SharePoint Server endpoint.
  2. Payload delivery: Attacker sends a crafted request containing a maliciously serialised data object to a vulnerable SharePoint component over the network. No authentication is required (PR:N).
  3. Deserialization & code execution: SharePoint deserialises the untrusted object, instantiating attacker-controlled types and executing arbitrary code within the SharePoint process context.
  4. Post-exploitation: With code execution achieved, the attacker operates with the privileges of the SharePoint application pool identity, enabling potential credential access, lateral movement, and data exfiltration.

Exploitation context: watchTowr confirmed active exploitation in the wild, and a public proof-of-concept is available. CISA's SSVC assessment classifies the vulnerability as exploitation: active, automatable: yes, technical impact: total. Microsoft credited DEVCORE for reporting the vulnerability. No specific threat actor attribution is available in the source material; any actor attribution is unconfirmed.

Related SharePoint CVEs in the KEV catalogue: The source material references additional SharePoint deserialization and authentication vulnerabilities patched in the same July 2026 cycle and prior cycles — CVE-2026-58644 (deserialization, KEV due 2026-07-19), CVE-2026-45659 (deserialization, CVSS 8.8, authorized attacker, KEV due 2026-07-04), and CVE-2026-56164 (missing authentication for critical function, KEV due 2026-07-17). Clients should verify all four are remediated, but CVE-2026-50522 is the most urgent due to its unauthenticated, critical nature and the 2026-07-25 KEV deadline.

Confidence caveat: The active exploitation claim and PoC existence are corroborated by both CISA KEV listing and The Hacker News reporting on watchTowr's findings. Technical details of the exploit payload, specific affected SharePoint versions, and the exact deserialisation endpoint are not available in the provided source material — clients should consult Microsoft's official security update guidance for version-specific patch mapping.

4. Mitigation & containment

P1 — within 24 hours

  • Identify all SharePoint Server instances across the estate, including on-premises, hybrid, and any internet-exposed deployments. Prioritise any SharePoint server with a public-facing endpoint.
  • Apply the Microsoft July 2026 Patch Tuesday security update for SharePoint Server immediately. This is the primary remediation. Consult Microsoft's Security Update Guide for the specific KB article applicable to your SharePoint version.
  • Isolate or restrict internet exposure of SharePoint Server instances wherever possible. If the service does not require internet-facing access, place it behind a VPN or zero-trust network access gateway. If internet exposure is a business requirement, ensure a WAF or reverse proxy with application-layer filtering is in place.
  • Verify remediation of the three additional SharePoint KEV entries (CVE-2026-58644, CVE-2026-45659, CVE-2026-56164) — all have earlier KEV due dates and should already be patched. Confirm and close any gaps.

P2 — within 72 hours

  • Conduct forensic triage on all SharePoint servers that were internet-exposed and unpatched between the July 2026 Patch Tuesday release (2026-07-14) and patch application. CISA's BOD 26-04 "Forensics Triage Requirements" guidance applies. Look for signs of exploitation: unexpected child processes spawned by the SharePoint application pool worker (w3wp.exe), anomalous network connections from the SharePoint server, newly created files or scheduled tasks, and evidence of credential dumping.
  • Review IIS logs for anomalous HTTP requests targeting SharePoint endpoints, particularly requests with unusually large or encoded payloads that may indicate deserialization exploit attempts.
  • Restrict SharePoint application pool identity privileges to least privilege. If the app pool runs as LOCAL SERVICE or a domain account with excessive rights, reduce permissions to limit post-exploitation impact.

P3 — within 7 days

  • Validate patch deployment across all environments including disaster recovery and backup sites.
  • Update vulnerability scanner configurations to flag any remaining unpatched SharePoint instances as critical.
  • Review and document the SharePoint attack surface as part of DORA Art. 24 operational resilience testing, ensuring future patch cycles for internet-exposed services are accelerated to meet KEV timelines.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

Behaviour Where to observe Confidence
Unexpected child processes spawned by w3wp.exe (SharePoint application pool worker) EDR / process monitoring on SharePoint servers Medium — consistent with deserialization RCE but not source-confirmed for this specific CVE
Anomalous inbound HTTP requests with large or encoded payloads targeting SharePoint endpoints IIS logs, WAF logs, network IDS Medium — expected exploit delivery pattern for deserialization attacks
Outbound network connections from SharePoint server to unfamiliar external IPs following suspicious inbound requests EDR, firewall logs, network flow data Medium — indicative of post-exploitation C2 or data exfiltration

6. Detection

Insufficient indicators to author detection rules. The source material does not contain specific exploit artefacts (strings, file paths, registry keys, mutex names, or command-line indicators) unique to this threat. Clients should rely on the behavioural indicators in §5 and standard deserialization attack detection patterns in their WAF and EDR tooling.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

CVE CVSS Exploited EPSS Summary
CVE-2026-50522 9.8 Critical ⚠ KEV 2026-07-22 20% Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

7. Sources

  • NVD, CVE-2026-50522 Detail, https://nvd.nist.gov/vuln/detail/CVE-2026-50522, modified 2026-07-23
  • CISA, Known Exploited Vulnerabilities Catalog — CVE-2026-50522, https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50522, added 2026-07-22
  • The Hacker News, "Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC", https://thehackernews.com/2026/07/critical-sharepoint-rce-cve-2026-50522.html, published 2026-07
  • NVD, CVE-2026-58644 Detail, https://nvd.nist.gov/vuln/detail/CVE-2026-58644
  • NVD, CVE-2026-45659 Detail, https://nvd.nist.gov/vuln/detail/CVE-2026-45659
  • NVD, CVE-2026-56164 Detail, https://nvd.nist.gov/vuln/detail/CVE-2026-56164
  • GitHub Security Advisories, GHSA-w3mh-jmwv-56f3, https://github.com/advisories/GHSA-w3mh-jmwv-56f3

8. Adverse Trace position

CVE-2026-50522 is a maximum-severity (CVSS 9.8), unauthenticated, network-accessible remote code execution vulnerability in a widely deployed enterprise product, with confirmed active exploitation, a public PoC, and CISA KEV listing with a 2026-07-25 remediation deadline. EMEA financial services clients with internet-exposed SharePoint Server instances are at critical risk and must treat patching as a P1 incident. The vulnerability is automatable and requires no user interaction, meaning mass exploitation is feasible. Clients should patch immediately, restrict internet exposure, and conduct forensic triage on any systems that were exposed and unpatched since the 14 July 2026 patch release. Adverse Trace will monitor for emerging IOCs, exploit kit details, and any confirmed threat actor attribution, and will issue a follow-up advisory if actionable indicators become available.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies