Critical SharePoint RCE flaw exploited to steal machine keys

Summary

Attackers are actively exploiting a critical remote code execution vulnerability (CVE-2026-50522) in Microsoft SharePoint to steal machine keys. This allows them to maintain persistent access and impersonate users even after servers are patched. The flaw, a deserialization-of-untrusted-data issue, was addressed in Microsoft's July security updates, but exploitation began shortly after a proof-of-concept exploit became publicly available.

Full text

Critical SharePoint RCE flaw exploited to steal machine keys By Bill Toulas July 21, 2026 04:06 PM 0 Hackers are actively exploiting the critical CVE-2026-50522 vulnerability in Microsoft SharePoint to steal machine keys and maintain access even after affected servers are patched. An attacker obtaining them can create valid authentication tokens to impersonate users and access available resources such as SharePoint sites and documents with the privileges of the forged identity. Microsoft describes the security issue as a deserialization-of-untrusted-data flaw that allows a remote attacker to execute code over a network without authentication. The flaw was addressed in July's security updates from Microsoft. It was not marked as actively exploited, but the advisory noted an increased likelihood of being leveraged. Offensive security company watchTowr has observed that hackers started to leverage CVE-2026-50522 against on-premise vulnerable SharePoint deployments, immediately after a valid proof-of-concept (PoC) exploit became public. “On July 20th, watchTowr identified proof-of-concept exploit code for this vulnerability,” watchTowr states. "Within hours, our global honeypot network, Attacker Eye, captured exploitation attempts using this PoC that successfully compromised target systems." The researchers note that the attackers are stealing machine keys that allow them to maintain long-term access on breached systems. Early warning threat intelligence company Defused detected "an undocumented SharePoint deserialization vector" being used in attacks as early as July 17 but could not link the activity to a flaw. Yesterday, the company said that the attacks were likely driven by exploiting the CVE-2026-50522 SharePoint vulnerability. Exploit released publicly At least one PowerShell demonstrative exploit for CVE-2026-50522 is available on GitHub from security researcher Janggggg. The PoC attempts to trigger remote code execution by delivering a malicious .NET ‘BinaryFormatter’ payload as the cookie of a forged ‘SecurityContextToken’ within a WS-Federation sign-in response posted to SharePoint's ‘/_trust/default.aspx’ endpoint. If the token is processed by a vulnerable deserialization path, the payload results in arbitrary code execution on the SharePoint server. BleepingComputer did not test the PoC exploit, but it looks structurally and technically legitimate. It should be noted that Janggggg's published the PoC on the same day watchTowr started to detect attacks leveraging it. However, it is unclear if the observed incidents made use of the publicly available exploit. While applying the latest SharePoint security updates removes the vulnerability, watchTowr advises defenders to also rotate credentials on any asset that may have been exposed. Test every layer before attackers do Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper Related Articles: Critical Langflow RCE flaw exploited to hack AI app serversDisgruntled researcher leaks “BlueHammer” Windows zero-day exploitCritical wp2shell WordPress flaws exploited to install webshellsSonicWall SMA1000 flaws exploited as zero-days to push custom malwareWordPress Core "wp2shell" RCE flaws get public exploits, patch now

Indicators of Compromise

• cve — CVE-2026-50522
• url — https://github.com/Janggggg/Exploits/blob/main/CVE-2026-50522.ps1

Entities