Fourth SharePoint Vulnerability Exploited in Past Month’s Wave of Attacks

Summary

A critical remote code execution vulnerability in Microsoft SharePoint, CVE-2026-50522, is being actively exploited by threat actors. The flaw allows attackers to steal machine keys, enabling long-term access to compromised systems. This marks the fourth SharePoint vulnerability exploited in the past month, highlighting ongoing risks for organizations using the platform.

Full text

The in-the-wild exploitation of yet another SharePoint vulnerability has come to light – the fourth in the past month. The flaw is tracked as CVE-2026-50522, and it was fixed by Microsoft on July 14 with its latest Patch Tuesday updates. Microsoft describes CVE-2026-50522 as a critical remote code execution vulnerability stemming from deserialization of untrusted data. “In a network-based attack, an attacker authenticated as at least a Site Owner, could write arbitrary code to inject and execute code remotely on the SharePoint Server,” the company wrote in its advisory. Threat intelligence firm Defused appears to be the first to have observed exploitation of CVE-2026-50522. The company reported on July 17 that its honeypots had seen exploitation attempts targeting what appeared to be a zero-day SharePoint vulnerability. However, in an update shared on July 20, Defused said the targeted vulnerability was likely CVE-2026-50522.Advertisement. Scroll to continue reading. One day later, shortly after PoC exploit code was released, security firm WatchTowr confirmed active exploitation. According to the company, threat actors are “stealing machine keys to retain long-term access”. “Attackers are pulling SharePoint machine keys via a single request,” WatchTowr noted, adding, “Patching is not enough; defenders should rotate credentials on any assets that may have been exposed.” Microsoft has yet to update its advisory for CVE-2026-50522 to confirm in-the-wild exploitation, but it’s not uncommon for the tech giant to delay updating its advisories after attacks are detected. The other SharePoint vulnerabilities whose exploitation has come to light in recent weeks are CVE-2026-58644, CVE-2026-56164, and CVE-2026-45659. CISA recently warned organizations about attacks targeting SharePoint instances. The agency’s Known Exploited Vulnerabilities (KEV) catalog currently includes 13 SharePoint flaws, including five added this year. CVE-2026-50522 has not yet been added to the KEV list. Related: Exploitation of ServiceNow Vulnerability Seen Days After Disclosure Related: SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch Related: WP2Shell WordPress Vulnerabilities Exploited in the Wild Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs Meta Paid $78,000 Bounty for Vulnerability Exposing Customer Support DataExploitation of ServiceNow Vulnerability Seen Days After DisclosureSonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before PatchNew Index Tracks Material Breaches — And Refuses to Add Up the LossesWP2Shell WordPress Vulnerabilities Exploited in the WildTwo Scattered Spider Hackers Sentenced to Jail in UK‘ClickLock Stealer’ Bypasses macOS Security With Social Engineering, Process KillingChina’s Top Cybersecurity Firms Hit by Mounting Military Procurement Bans Latest News Endpoint Security Firm Glow Launches With $180M in Funding at $1.2B ValuationOracle Patches Over 1,400 Vulnerabilities With Quarterly Security UpdatesRansomware Group Threatening to Leak Data Stolen From Coca-Cola’s FairlifeOpenAI Says Its AI Models Broke Loose and Hacked Hugging Face Trump Orders Defense Contractors to Map Software, Suppliers Across Critical Supply ChainsCisco Launches Low-Cost AI Models for Source Code SecurityEmpirical Security Raises $25 Million in Series A FundingSecurityWeek Launches Critical Impact Awards to Recognize Excellence in Industrial Cybersecurity Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Closing the Exploitation Gap July 22, 2026 Join this live webinar as we explore why exploitation is outpacing remediation, where risk is growing fastest, and what security leaders can do to close the gap before attackers take advantage. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveJazz has named Sean Robinson, Rickie Goyal, Danielle Guetta, Shani Nago, and Lior Magram as VPs and Michael Calev as COO.AJ Shipley has been appointed Chief Product Officer at CrowdStrike.Brinqa has named Ron Dovich as Chief AI and Automation Officer, David Allen as CTO, Steve Biagioni as CFO, and James Walta as VP of Product.More People On The MoveExpert Insights Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts. (Tod Beardsley) The Shift Toward Business-Aligned Risk Management Moving from isolated, technical data to a continuous risk lifecycle can help organizations align security controls with actual business consequences. (Steve Durbin) How to Conduct a Successful Audit of AI-Driven Software Development As AI-generated code becomes commonplace, CISOs need new audit strategies to measure developer practices, govern AI tool usage, and identify software risks before they reach production. (Matias Madou) Frontier AI: Six Questions Every Enterprise Should Ask Security Vendors From model selection and automation to validation and measurable results, the right questions can help enterprises separate genuine AI capabilities from marketing hype. (Joshua Goldfarb) The AI Token Costs That Can Break Cybersecurity As cybersecurity platforms embrace agentic AI, organizations must balance detection performance against the escalating costs of token consumption, deployment architecture, and AI credits. (Danelle Au) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-50522
• cve — CVE-2026-58644
• cve — CVE-2026-56164
• cve — CVE-2026-45659

Entities