Active Deserialization Exploitation: SharePoint RCE (CVE-2026-50522) Leads to ASP.NET MachineKey Theft
Executive Summary
A critical remote code execution (RCE) vulnerability in on-premises Microsoft SharePoint Server, tracked as CVE-2026-50522 (CVSS score 9.8), has come under active, widespread exploitation by threat actors following the public disclosure of Proof-of-Concept (PoC) exploit code. On July 22, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-50522 to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies and enterprise defenders to apply patches immediately.
The vulnerability, caused by the deserialization of untrusted data in SharePoint's web processing pipeline, affects on-premises 64-bit deployments of Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Recent incident response investigations by security researchers at watchTowr and Resecurity reveal that active attack campaigns are deploying web shells (such as spinstall0.aspx) to exfiltrate IIS ASP.NET machineKey encryption material. By stealing these keys, threat actors can forge valid authentication cookies and maintain persistent access across domain assets even after security patches are applied.
Deep-Dive Technical Analysis
The vulnerability centers on unsafe object deserialization routines within SharePoint's web endpoints handling incoming SOAP and HTTP requests:
1. Deserialization Mechanics: An attacker constructs a specially crafted, serialized object payload containing malicious gadget chains and transmits it over the network to vulnerable SharePoint endpoints. Because the application fails to validate or restrict incoming serialized data, the process deserializes the untrusted payload, leading to arbitrary code execution in the security context of the SharePoint application pool (w3wp.exe).
2. Exploitation Prerequisites: The attack vector is Network (AV:N), remotely exploitable over the internet with Low Attack Complexity (AC:L) and requiring no prior authentication or user interaction in many unpatched configurations.
3. Post-Exploitation and MachineKey Theft: Forensic analysis reveals that once initial RCE is achieved, attackers routinely drop ASP.NET web shells (e.g., spinstall0.aspx) into IIS web roots to execute a secondary stage: extracting the ASP.NET machineKey configuration from web.config files.
4. The MachineKey Threat: In ASP.NET architecture, machineKey contains the cryptographic keys used to encrypt and validate ViewState, Session State, and Forms Authentication cookies. By exfiltrating this key, attackers gain the ability to offline-generate valid, cryptographically signed administrative session cookies—enabling persistent backdoor access and domain escalation that bypasses standard patch installations.
Industry Impact and Recommendations / Mitigations
The active exploitation of SharePoint servers poses an extreme risk, as SharePoint typically connects directly to internal Active Directory, SQL databases, and enterprise document repositories.
Recommended Mitigation Steps:
* Apply Microsoft Security Patches Immediately: Deploy the July 2026 Patch Tuesday security updates for all affected versions of SharePoint Server 2016, 2019, and Subscription Edition.
* Rotate ASP.NET MachineKeys: Patching the software is insufficient if an attacker has already compromised the server and stolen configuration files. Organizations MUST immediately rotate and regenerate all IIS and SharePoint machineKey values across all web front-ends.
* Conduct Forensic Threat Hunting: Hunt for suspicious ASPX web shells (e.g., spinstall0.aspx) across all IIS web directories (typically under C:\Program Files\Common Files\microsoft shared\Web Server Extensions\).
* Audit IIS Application Pool Process Execution: Monitor process execution logs for w3wp.exe spawning unexpected command interpreters like cmd.exe, powershell.exe, or certutil.exe.
References:
* Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC
* CISA Known Exploited Vulnerabilities Catalog - CVE-2026-50522
* Understanding the July 2026 SharePoint Attacks - Resecurity Analysis