CVE-2026-50522

What is Microsoft SharePoint Server?

Microsoft SharePoint Server is the on-premises document management, collaboration, and intranet platform used by enterprises and government agencies that run their own infrastructure rather than SharePoint Online. It stores an organization's internal documents and workflows and integrates tightly with Active Directory and Exchange, so a compromised SharePoint server typically gives an attacker a foothold with broad reach into the rest of the internal network — the same pattern exploited at scale in the 2025 "ToolShell" SharePoint campaign.

Overview

CVE-2026-50522 is a deserialization of untrusted data vulnerability (CWE-502) in SharePoint Server's SessionSecurityTokenHandler — part of the Windows Identity Foundation token-processing stack — that allows remote code execution. Microsoft's published CVSS vector describes it as unauthenticated and network-exploitable (9.8 Critical), though Microsoft's advisory prose separately notes that an attacker authenticated as at least a Site Owner is involved in the described attack path — a discrepancy between the scored vector and the written description worth flagging rather than resolving one way. It was patched on July 14, 2026 via KB5002882, with a public proof-of-concept appearing July 20 and honeypot-observed exploitation following within hours. Security researchers describe it as the third or fourth SharePoint vulnerability exploited in a broader wave of attacks over the preceding month, alongside CVE-2026-56164 and CVE-2026-45659 (both already covered on this site) — independent bugs from the same period rather than variants of a single patch.

Affected Versions

SharePoint Online (Microsoft 365) is not affected — Microsoft manages patching for the cloud service directly.

Technical Details

The vulnerability arises from insufficient validation before deserializing user-supplied data in SessionSecurityTokenHandler, the WIF component SharePoint uses to process authentication session tokens. An attacker who can submit a crafted serialized payload to a SharePoint sign-in endpoint can trigger unsafe deserialization, executing attacker-controlled code in the context of the SharePoint service account. Post-patch analysis by multiple firms found that attackers exploiting the flaw were able to steal SharePoint machine keys (ASP.NET machineKey values) in a single request — the same persistence technique seen in prior ToolShell-style SharePoint deserialization attacks, allowing continued access even after the server is patched if keys aren't rotated.

Discovery

Credited by Microsoft to researcher "splitline" of DEVCORE.

Exploitation Context

A public proof-of-concept surfaced on July 20, 2026, six days after the patch shipped, and watchTowr's honeypot network captured exploitation attempts within hours of the PoC's release — consistent with attackers reverse-engineering the patch diff to reconstruct a working exploit. CISA added the CVE to KEV on July 22, 2026 with a three-day remediation deadline. CISA's KEV entry attributes exploitation only to generic malicious cyber threat actors, with no named APT or group.

Remediation

1. Apply KB5002882 (or the equivalent July 2026 cumulative update for your SharePoint edition) immediately — there is no workaround for a deserialization flaw of this kind.
2. Rotate SharePoint machine keys (ASP.NET machineKey) after patching, given confirmed key-theft in observed attacks; failing to rotate keys leaves attackers able to forge valid tokens even on a patched server.
3. Restrict internet exposure of on-premises SharePoint servers — they should sit behind a reverse proxy/WAF with strict request validation if full network isolation isn't feasible.
4. Review IIS and SharePoint ULS logs for anomalous requests to sign-in/token endpoints and unexpected w3wp.exe child processes around and after July 14, 2026.
5. Assume compromise if the server was unpatched and internet-facing before July 20, 2026 — rotate all associated credentials and inspect for webshells or scheduled tasks dropped via the application pool identity, in addition to the machine-key rotation above.