Summary
A critical deserialization vulnerability in Microsoft Office SharePoint, tracked as CVE-2026-50522 (CVSS 9.8), is under active exploitation in the wild. Threat actors are chaining this flaw with other SharePoint vulnerabilities to gain unauthorized remote code execution on affected servers.
Microsoft released security updates on July 14, 2026, but researchers from watchTowr and Defused Cyber confirmed active exploitation attempts shortly after a public proof-of-concept exploit emerged around July 20–21. Attackers are leveraging the vulnerability to steal SharePoint machine keys, then forge authentication tokens to maintain persistent access — even on patched servers.
CISA has warned about a cluster of actively exploited SharePoint Server vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522) impacting all supported self-hosted SharePoint versions. watchTowr explicitly stated: “patching is not enough; defenders should rotate credentials on any assets that may have been exposed.”
Source
The Hacker News — Critical SharePoint RCE CVE-2026-50522
Cybersecurity Dive — Microsoft SharePoint attack
SecurityWeek — Fourth SharePoint vulnerability exploited
Commentary
This is a textbook example of why “patch Tuesday” doesn’t mean “patch safe.” The attack chain here is sophisticated: exploit the RCE, steal the machine key, forge authentication tokens, and maintain access even after the vulnerability is patched. It turns the patch itself into a false sense of security.
For blue teams, the immediate action items are clear: (1) verify patch application, (2) rotate all credentials on affected SharePoint servers, (3) audit SharePoint logs for the exploitation pattern, and (4) check for forged authentication tokens. Organizations using SharePoint Online should also review their configurations, though the primary impact is on-premises deployments.
The cluster of five actively exploited SharePoint vulnerabilities in a single month is alarming. It suggests a coordinated campaign rather than opportunistic exploitation. Defenders should treat this as an active incident, not just a vulnerability to patch.