Active Exploitation Alert: Critical SharePoint RCE Flaw CVE-2026-50522 Used to Steal ASP.NET Machine Keys
Executive Summary
Threat intelligence analysts and incident response teams have confirmed active, in-the-wild exploitation of a critical remote code execution (RCE) vulnerability affecting on-premises installations of Microsoft SharePoint Server. Tracked as CVE-2026-50522 (CVSS 9.8), the security flaw stems from the insecure deserialization of untrusted user input within SharePoint's core processing engine. Discovered and responsibly reported by DEVCORE researcher "splitline" and patched by Microsoft during the July 2026 Patch Tuesday updates, the vulnerability is now under aggressive, automated targeting by threat actors.
Crucially, forensic investigations reveal that attackers are weaponizing initial RCE access specifically to exfiltrate the host server's ASP.NET Machine Keys (validationKey and decryptionKey). Once these cryptographic keys are stolen, threat actors can forge valid ASP.NET ViewState payloads and authentication cookies—granting them persistent administrative access that survives official patch deployments and service restarts.
Deep-Dive Technical Analysis
The vulnerability lives in SharePoint's handling of serialized ASP.NET objects passed across network-facing endpoints:
1. Insecure Deserialization Vector: Unauthenticated or low-privilege remote attackers construct crafted HTTP POST requests containing serialized .NET object graphs. When processed by SharePoint's web front-end, the application fails to validate class types before invoking deserialization routines, allowing arbitrary code execution within the IIS application pool (w3wp.exe) worker context.
2. Exfiltration of ASP.NET Machine Keys: Forensic analysis from threat intelligence firm Defused demonstrates that active exploit chains immediately target the server's web.config files and local registry hives to extract the static ASP.NET machine keys. These keys are responsible for signing and encrypting ViewState data, Forms Authentication tickets, and session tokens.
3. Persistent Backdoor via Key Forgery: Armed with the stolen Machine Keys, an attacker no longer needs to exploit CVE-2026-50522. They can externally encrypt and sign malicious ViewState payloads using the stolen keys, transmitting them to any ASP.NET page on the target server. The server will natively trust, decrypt, and execute the payload—granting the attacker permanent, unauthenticated remote code execution that bypasses standard patch installations.
Industry Impact and Mitigations
The active exploitation of CVE-2026-50522 poses a critical risk to government agencies, healthcare providers, and corporate enterprises operating on-premises SharePoint Server deployments (cloud-hosted SharePoint Online tenants remain unaffected):
* Immediate Patch Deployment: System administrators must immediately apply Microsoft's July 2026 security updates for on-premises SharePoint Server 2016, 2019, and Subscription Edition.
* Mandatory Machine Key Rotation: Patching alone is insufficient if an intrusion occurred prior to patch installation. Organizations must immediately regenerate and rotate all ASP.NET Machine Keys across all SharePoint web applications to invalidate any potentially exfiltrated cryptographic material.
* ViewState Encryption & IIS Hardening: Ensure ASP.NET ViewState MAC validation (EnableViewStateMac="true") is strictly enforced and transition to dynamic, auto-generated machine keys across cluster nodes where feasible.
* Threat Hunting & Log Review: Inspect IIS access logs and Event Viewer logs for suspicious w3wp.exe child process spawns (e.g., cmd.exe, powershell.exe) and unexpected read queries targeting web.config files.
References
* Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC
* Fourth SharePoint Vulnerability Exploited in Past Month's Wave of Attacks