Summary
A critical deserialization vulnerability in Microsoft Office SharePoint, tracked as CVE-2026-50522 (CVSS 9.8), is under active exploitation. Threat actors chain this flaw with other SharePoint vulnerabilities to gain unauthorized remote code execution.
Microsoft released patches on July 14, 2026, but researchers from watchTowr and Defused Cyber confirmed active exploitation attempts after a public proof-of-concept emerged around July 20-21. Attackers steal SharePoint machine keys to forge authentication tokens, maintaining persistent access even on patched servers.
CISA warns about a cluster of actively exploited SharePoint Server vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522) impacting all supported self-hosted SharePoint versions. watchTowr stated: “patching is not enough; defenders should rotate credentials on any assets that may have been exposed.”
Source
The Hacker News
Cybersecurity Dive
SecurityWeek
Commentary
This is textbook: exploit the RCE, steal the machine key, forge tokens, maintain access even after patching. The patch itself becomes a false sense of security.
Blue teams should: (1) verify patch application, (2) rotate all credentials on affected SharePoint servers, (3) audit logs for exploitation patterns, and (4) check for forged tokens. The cluster of five actively exploited SharePoint vulnerabilities in one month suggests a coordinated campaign, not opportunistic exploitation. Treat this as an active incident.