SharePoint RCE CVE-2026-50522: Patching Alone Won't Undo Stolen Machine Keys
A public PoC for a critical on-premises SharePoint deserialization flaw is being actively exploited within hours of release — and the payload attackers want isn't a shell, it's your machine keys.
Key Takeaways
- CVE-2026-50522 (CVSS 9.8) is a deserialization-of-untrusted-data flaw in on-premises Microsoft SharePoint Server that enables remote code execution.
- watchTowr's honeypots recorded working exploitation within hours of a public PoC landing on 20 July 2026.
- Attackers are using the bug to exfiltrate SharePoint machine keys in a single request, letting them forge valid authentication tokens that survive patching.
- Applying the July 2026 patch is necessary but not sufficient — exposed machine keys and other credentials must also be rotated.
What happened
CVE-2026-50522 is a critical (CVSS 9.8) deserialization-of-untrusted-data vulnerability in on-premises Microsoft SharePoint Server, patched in the July 2026 Patch Tuesday round. Once a proof-of-concept went public on 20 July 2026, watchTowr's global honeypot network captured working exploitation attempts within hours — the familiar pattern for on-prem SharePoint RCEs, where the gap between disclosure and mass scanning is now measured in hours, not days.
Why machine-key theft is the real story
The interesting part of this campaign isn't the initial code execution — it's what attackers do with it. Per BleepingComputer, attackers are pulling SharePoint's ASP.NET machine keys via a single request. Machine keys are used to sign and encrypt ViewState and authentication tokens; anyone holding them can forge valid tokens and impersonate any user, including administrators, without needing credentials or a live session.
That's what makes this exploitation chain dangerous well past remediation day: a stolen machine key is a durable, offline forgery capability. An attacker who grabbed it before you patched can keep minting valid tokens against your SharePoint farm indefinitely, because the patch closes the RCE path but does nothing to invalidate keys already exfiltrated.
Part of a pattern, not an isolated bug
On-premises SharePoint has had a rough run: SecurityWeek describes CVE-2026-50522 as at least the fourth SharePoint on-prem vulnerability exploited in a single month's wave of attacks. Whatever the underlying cause, defenders running on-prem SharePoint should currently treat every new advisory for the platform as a probable near-term exploitation event, not a routine patch-cycle item.
What to do now
- Apply the July 2026 SharePoint Server security update immediately if you haven't already.
- Rotate ASP.NET machine keys on every on-prem SharePoint farm, whether or not you've confirmed compromise — treat exposure as the default assumption for internet-reachable instances.
- Recycle IIS application pools after key rotation so cached keys aren't still in use.
- Hunt for indicators of compromise: unexpected webshells under SharePoint web roots, anomalous service-account authentication, and forged-looking tokens issued outside normal user activity windows.
- If the server is internet-facing and you can't rule out pre-patch exploitation, treat it as a suspected breach and scope an investigation rather than closing the ticket at 'patched'.
Authentication requirements for CVE-2026-50522 vary by source — some describe a need for Site Owner privileges, others note unauthenticated exploitation was observed in the wild — which is one more reason to assume the worst rather than wait for a definitive answer before rotating keys.
Frequently Asked Questions
What is a SharePoint machine key and why does stealing it matter?
It's a cryptographic key SharePoint's ASP.NET stack uses to sign and encrypt ViewState and authentication tokens. Anyone who has it can forge valid tokens and impersonate users — including admins — without needing a password or an active session, and that capability persists even after the underlying RCE is patched.
Is SharePoint Online (Microsoft 365) affected by CVE-2026-50522?
Reporting on this flaw specifically identifies on-premises SharePoint Server as the affected product. If you run SharePoint Online exclusively, this particular advisory doesn't apply, but it's worth confirming with Microsoft's own advisory for your exact deployment.
We already patched — are we safe?
Not necessarily. Patching closes the code-execution path but does not invalidate machine keys stolen before the patch was applied. Security researchers are explicit that credential rotation is required in addition to patching to close out exposure.
Sources
- 1Public PoC triggers active exploitation of critical SharePoint RCE vulnerability CVE-2026-50522 — Security Affairs
- 2Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC — The Hacker News
- 3Critical SharePoint RCE flaw exploited to steal machine keys — BleepingComputer
- 4Fourth SharePoint Vulnerability Exploited in Past Month's Wave of Attacks — SecurityWeek