A public proof of concept for a critical SharePoint flaw turned into active exploitation within hours this week, and the attackers are not stopping at code execution. According to Microsoft’s advisory, CVE-2026-50522 is a deserialization of untrusted data bug, rated 9.8 on the CVSS scale, that lets an authenticated attacker with Site Owner permissions execute code remotely on on-premises SharePoint Server 2016, 2019, and Subscription Edition. Security vendor watchTowr says its honeypot network began capturing successful exploitation attempts within hours of a public PoC surfacing on July 20, with attackers using the flaw to pull SharePoint machine keys in a single request.
That detail is the one worth a CISO’s attention. Machine keys let an attacker forge valid authentication tokens and impersonate users on the server, which means patching the deserialization bug does not evict an intruder who already grabbed the keys before the patch went in. Rotating those keys, not just applying the update, is what actually ends the access. CVE-2026-50522 has not yet been added to CISA’s Known Exploited Vulnerabilities catalog, unlike a related SharePoint flaw already listed there, a gap that may understate how urgently on-prem SharePoint estates need attention this month.
The real signal is how routine this has become. As CyberTech covered when a new ServiceNow flaw was exploited within five days of disclosure, the gap between a vulnerability going public and attackers weaponizing it has collapsed across on-premises enterprise software generally, not just SharePoint. What is new here is the follow-through: attackers are increasingly treating initial code execution as step one of a persistence plan built around stealing long-lived secrets, which means a “patched” status in a vulnerability scanner can no longer be read as evidence that an environment is actually clean.
