Critical SharePoint RCE (CVE-2026-50522) Under Active Exploitation: Public Exploit Code and Machine Key Theft Threaten Enterprise Server Farms
Executive Summary
Threat actors have begun actively exploiting a critical Remote Code Execution (RCE) vulnerability in Microsoft SharePoint Server, tracked as CVE-2026-50522, following the public disclosure of proof-of-concept (PoC) exploit code. With a maximum CVSS v3.1 severity rating of 9.8, this vulnerability allows unauthenticated, remote attackers to execute arbitrary code on vulnerable on-premises SharePoint deployment servers without requiring user interaction or valid credentials.
Discovered by security researcher "splitline" from DEVCORE, the flaw stems from insecure .NET untrusted data deserialization during HTTP POST requests to SharePoint sign-in and authentication endpoints. Alarmingly, threat telemetry from attack surface monitoring firms such as watchTowr and Defused confirms that attackers are leveraging this RCE vector not only to gain initial access, but to exfiltrate Internet Information Services (IIS) cryptographic machine keys (web.config) (Cybersecurity Dive). Stolen machine keys allow attackers to forge ASP.NET ViewState tokens and maintain persistent, unauthenticated backdoors across entire server farms—even after software security patches are installed (BleepingComputer).
This advisory breaks down the technical mechanics of CVE-2026-50522, places it within the broader July 2026 SharePoint exploitation wave, and provides an urgent remediation playbook for enterprise security teams.
Deep-Dive Technical Analysis: CVE-2026-50522
Root Cause: .NET Deserialization of Untrusted Data
CVE-2026-50522 is an unauthenticated deserialization flaw embedded in Microsoft SharePoint Server's core authentication pipeline. The vulnerability manifests during the handling of crafted HTTP POST requests sent to pre-authentication sign-in endpoints.
When an incoming POST request containing serialized .NET object payloads is submitted to the endpoint, SharePoint fails to properly restrict or validate the object types before instantiating them. By abusing gadgets available within the .NET Framework class libraries loaded by IIS worker processes (w3wp.exe), an unauthenticated attacker can construct a payload that triggers arbitrary command execution upon deserialization.
* Attack Complexity: Low (requires no prior credentials or internal environment knowledge).
* Attack Vector: Network-accessible (AV:N / AC:L / PR:N / UI:N).
* Execution Privileges: Commands execute under the security context of the SharePoint Application Pool identity or IIS service account, providing immediate access to local configuration files, internal APIs, and connected SQL database instances.
Post-Exploitation Tradecraft: Cryptographic Machine Key Harvesting
The most dangerous operational aspect of CVE-2026-50522 is the post-exploitation tradecraft documented in active intrusions (Cybersecurity Dive). Upon achieving initial RCE, adversaries immediately search for and exfiltrate the IIS web.config file to extract cryptographic machineKey values (including validationKey and decryptionKey).
In ASP.NET and SharePoint architectures, IIS machine keys sign and encrypt ViewState data, session cookies, and anti-forgery tokens. Once an attacker possesses these secret keys:
1. They can independently craft and encrypt malicious ViewState payloads offline using tools like YSoSerial.NET.
2. They can transmit these encrypted payloads to any web page within the SharePoint farm that processes ViewState.
3. The server validates the signature using its legitimate machine key and deserializes the payload, triggering RCE at will.
Consequently, patching the software binaries alone does not evict an attacker who has stolen machine keys. The attacker retains full, unauthenticated backdoor access until the compromised keys are explicitly revoked and regenerated (BleepingComputer).
Contextual Analysis: The July 2026 SharePoint Exploitation Wave
CVE-2026-50522 is part of a broader, highly aggressive campaign targeting on-premises Microsoft SharePoint infrastructure throughout July 2026. Security researchers note that the current threat activity exhibits "ToolShell-class impact," echoing major historical enterprise intrusions (Cybersecurity Dive).
The vulnerability operates alongside several sibling flaws addressed in recent security updates:
* CVE-2026-58644 (CVSS 9.8): A critical deserialization RCE vulnerability added to CISA's Known Exploited Vulnerabilities (KEV) catalog on July 16, 2026.
* CVE-2026-56164 (CVSS 5.3/9.8): An unauthenticated privilege escalation vulnerability discovered during active incident response by Mandiant and Google FLARE.
* CVE-2026-32201 & CVE-2026-45659: Earlier spoofing and deserialization flaws frequently chained together in automated scanner scripts to identify vulnerable farm endpoints.
Threat actors are systematically scanning internet-facing IP ranges for exposed SharePoint servers, running automated exploit chains to harvest machine keys, and dropping web shells (such as spinstall0.aspx) to establish redundant persistence mechanisms across enterprise networks (BleepingComputer).
Industry Impact & Scope
The impact of this exploitation wave is widespread:
* Affected Software: Microsoft SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition (on-premises).
* End-of-Support Risk: Notably, SharePoint 2016 and 2019 reached End of Extended Support on July 14, 2026—the exact day Microsoft released security patches—underscoring the urgent imperative for legacy migrations.
* Exposed Footprint: Global telemetry from the Shadowserver Foundation indicates over 1,000 internet-facing SharePoint instances remain vulnerable, with nearly half located across North American enterprise and government networks.
Actionable Mitigation & Response Playbook
To effectively remediate CVE-2026-50522 and neutralize post-exploitation persistence, organizations must execute a two-phase response:
Phase 1: Software Patching & Binary Updates
1. Apply Cumulative Updates Immediately: Install the July 2026 Security Updates (e.g., KB5002882, KB5002883, or KB5002891 depending on your version) across all SharePoint farm member nodes.
2. Execute PSConfig: Complete the installation by executing the SharePoint Products Configuration Wizard (psconfig.exe -cmd upgrade -inplace b2b_upgrade -wait) on every server node to ensure database schema and core assembly updates are properly finalized.
Phase 2: Mandatory Key Rotation & Forensic Eviction
Installing software patches closes the initial entry vector but will not invalidate stolen machine keys. Systems administrators must complete the following steps:
1. Rotate IIS Machine Keys: Regenerate all ASP.NET validationKey and decryptionKey values inside the web.config files across every web application and farm node using IIS Manager or automated PowerShell scripts.
2. Reset Farm Credentials: Reset passwords for all SharePoint service accounts, Application Pool accounts, and administrative accounts associated with the farm.
3. Forensic Log Threat Hunting:
* Inspect IIS access logs and SharePoint ULS logs for anomalous HTTP POST requests directed toward sign-in or ViewState handling endpoints prior to patching.
* Scan virtual directories (e.g., _layouts or ControlTemplates) for newly created or unauthorized .aspx files or web shells.
* Monitor process creation trees from w3wp.exe for unexpected command-line spawns (cmd.exe, powershell.exe).
4. Enable AMSI Integration: Ensure Microsoft Antimalware Scan Interface (AMSI) integration is enabled for all SharePoint web applications to facilitate real-time payload inspection.
For ongoing updates on enterprise vulnerability disclosures, threat research, and mitigation guides, visit digitalspying.com.