An unauthenticated attacker can run code on your SharePoint server with a single crafted request. There's a public PoC, it's under active exploitation, and Microsoft already shipped the fix. Patch today.
If you run an on-prem SharePoint server, stop and check your patch level: CVE-2026-50522 is a critical, unauthenticated remote code execution flaw with a CVSS score of 9.8, there's a public proof-of-concept, and it is under active exploitation right now. An attacker needs no credentials and no user interaction — just a single crafted HTTP request — to run code as the SharePoint service account. Microsoft shipped a fix on July 14, 2026. If you haven't applied it, you are exposed today.
What the flaw actually is
CVE-2026-50522 is a deserialization of untrusted data vulnerability. The root cause sits in the SessionSecurityTokenHandler class, part of the Windows Identity Foundation token-processing framework that .NET applications use. SharePoint reconstructs .NET objects from incoming data streams without validating the type or contents of the serialized payload first, so an attacker can supply a malicious serialized blob containing a gadget chain that executes arbitrary code during object reconstruction. In plain terms: the server trusts data it should never have trusted, and rebuilds it into a running attack. Because the vulnerable endpoint is reachable pre-authentication, the attacker doesn't need to log in — they send a crafted HTTP request and gain code execution in the context of the SharePoint service account, which is typically highly privileged.
CVE-2026-50522 at a glance
CVSS
Field
9.8 (Critical)
Type
Field
Unauthenticated RCE (deserialization)
Auth / interaction
Field
None required
Affected
Field
SharePoint Subscription Edition, 2019, 2016
Status
Field
Actively exploited, public PoC
Fix
Field
Microsoft update, July 14, 2026
Field
Detail
CVSS
9.8 (Critical)
Type
Unauthenticated RCE (deserialization)
Auth / interaction
None required
Affected
SharePoint Subscription Edition, 2019, 2016
Status
Actively exploited, public PoC
Fix
Microsoft update, July 14, 2026
The flaw deserializes attacker-controlled data without validation — one crafted request becomes code execution. · Unsplash
What to do right now
Apply Microsoft's July 14, 2026 SharePoint security update immediately on all affected servers.
Assume breach if you were unpatched and internet-facing — hunt for web shells and unusual w3wp.exe child processes.
Rotate the SharePoint machine keys and service-account credentials after patching, since code ran in that context.
Restrict external access to SharePoint where possible, and put it behind a WAF or VPN.
Quick answers
What is CVE-2026-50522?
CVE-2026-50522 is a critical (CVSS 9.8) unauthenticated remote code execution vulnerability in Microsoft SharePoint Server. It's caused by unsafe deserialization of untrusted data in the SessionSecurityTokenHandler class: SharePoint rebuilds .NET objects from an incoming request without validating them, letting an attacker send a crafted serialized payload that executes code as the SharePoint service account. No authentication or user interaction is required. It affects SharePoint Subscription Edition, 2019, and 2016, and Microsoft released a fix on July 14, 2026.
Is CVE-2026-50522 being exploited?
Yes. A public proof-of-concept exploit has been released, and the vulnerability is under active exploitation in the wild. It's part of a broader wave of SharePoint attacks in mid-2026. Because it requires no authentication and no user interaction — just a single crafted HTTP request — it's straightforward to exploit at scale against internet-facing SharePoint servers. Any affected server that was exposed and unpatched should be considered potentially compromised, not just vulnerable, so patching alone may not be sufficient.
How do I fix CVE-2026-50522?
Apply Microsoft's SharePoint security update from July 14, 2026 to all affected servers (Subscription Edition, 2019, and 2016) immediately. Because the flaw is actively exploited, also treat a previously-exposed server as potentially breached: hunt for web shells and unusual processes, rotate the SharePoint machine keys and service-account credentials after patching (code ran in that context), review logs for your exposure window, and restrict external access behind a WAF or VPN. Patching stops future attacks but won't remove an attacker who already got in.
CVE-2026-50522 is exactly the kind of fast-moving, unauthenticated RCE that gets mass-exploited within days of a public PoC — patch now, then verify you weren't already hit. It's not an isolated incident either: see the SharePoint attack wave and the related CVE-2026-58644 RCE. Sources: The Hacker News and Microsoft's MSRC advisory.
