Critical SharePoint RCE (CVE-2026-50522, CVSS 9.8) Under Active Exploitation — Attackers Are Stealing Machine Keys

CVE-2026-50522, a critical remote code execution flaw in on-premises Microsoft SharePoint Server, is under active exploitation following the release of a public proof-of-concept. WatchTowr logged exploitation attempts starting July 20, and attackers are using the bug for more than one-off code execution — they’re stealing machine keys to maintain persistent access even after a server gets patched.

The vulnerability: insufficient validation before deserializing user-supplied data inside the SessionSecurityTokenHandler class. The public exploit chain forges a SecurityContextToken inside a WS-Federation sign-in response, embeds a malicious .NET BinaryFormatter payload in the token’s cookie, and posts it to SharePoint’s /_trust/default.aspx endpoint. If the server’s deserialization path processes it, the attacker gets arbitrary code execution — no authentication required. CVSS score: 9.8.

Affected versions: SharePoint Server 2016, Server 2019, and Subscription Edition (on-premises). SharePoint Online in Microsoft 365 is not affected — this is a self-hosted-only problem.

Why patching isn’t the end of it: once attackers get code execution, they extract the server’s machine keys in a single request. Machine keys are what SharePoint uses to validate ViewState and other cryptographic tokens — stealing them lets an attacker forge valid authentication tokens and maintain access to the farm indefinitely, even after the underlying RCE is patched. If your farm was internet-facing and unpatched between July 14 and now, assume compromise and rotate machine keys as a separate remediation step, not an afterthought.

What to do right now, in order:

1. Apply Microsoft’s July 14, 2026 SharePoint security update immediately if you haven’t. Treat any internet-facing farm as an emergency change, not routine patch cadence.
2. Rotate SharePoint machine keys on every affected farm regardless of patch timing — assume the keys are already compromised if the server was exposed.
3. Audit for indicators of the WS-Federation exploit chain: unexpected traffic to /_trust/default.aspx, anomalous SecurityContextToken cookies, and unfamiliar service accounts or scheduled tasks created after July 14.
4. If you can’t patch immediately, restrict external access to /_trust/default.aspx at the network layer as a stopgap — not a fix.

This is the second major SharePoint on-prem RCE this year to get chained with credential theft post-exploitation, reinforcing that self-hosted SharePoint farms exposed to the internet remain one of the highest-value, most consistently targeted entry points in enterprise environments.

Sources

• Another SharePoint RCE exploited: Patch, then rotate your machine keys (CVE-2026-50522)
• Critical SharePoint RCE flaw exploited to steal machine keys
• Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC