Critical SharePoint Server vulnerability actively exploited
Deserialisation of untrusted data in on-premises SharePoint Server allows remote code execution; fixed in July and exploited after a proof of concept was published.
What happened
Vulnerability CVE-2026-50522 has a CVSS score of 9.8 and consists of deserialisation of untrusted data that allows remote code execution in on-premises SharePoint Server: Subscription Edition, 2019 and 2016. It was fixed in the July 2026 Patch Tuesday and began to be exploited after a proof of concept was published. Attackers steal machine keys to keep access.
Why it matters
Patching is not enough in this case. If the attacker has already got in and taken the machine keys, they can keep issuing valid elements for the server even with the flaw closed: the access survives the update. And a SharePoint farm is not updated in an afternoon, so the time between the proof of concept and the effective patch on every server is exactly the time in which entry is possible. The result is a flaw fixed in a day and exploited for weeks wherever the server inventory is not up to date, and that inventory is what decides when it is actually closed.
What we recommend
Apply the patch on every server in the farm, rotate the machine keys and look for signs of intrusion. Patching without rotating the keys leaves the door the attacker opened exactly as it was, so the two things go together or neither is of any use.
Related service: infraestructura-cloud · respuesta-incidentes
Want to know how it affects you?
We review your environment and tell you what to prioritise, with no commitment.