Critical Share Point RCE CVE-2026-50522 Under Active Exploitation After Public PoC
Summary: CVE-2026-50522, a critical deserialization flaw in Microsoft Office SharePoint with a CVSS score of 9.8, is under active exploitation against on-premises deployments after a public proof-of-concept exploit was released, according to watchTowr. Attackers are pulling SharePoint machine keys via a single request to maintain persistent access, and Defused Cyber reported requests carrying no authentication material delivering a .NET deserialization payload to a SharePoint sign-in endpoint.
What's compelling: This is the third SharePoint Server flaw exploited in July 2026, and CISA added it to its KEV catalog on July 22 with a July 25 deadline for federal agencies - but watchTowr warns patching alone is not enough, since stolen machine keys let attackers keep persistent access even after the fix is applied.