A Patch, a Public Exploit, and Then Attackers Showed Up
On July 8, Microsoft shipped its monthly Patch Tuesday release: more than 570 fixes, three of them for zero-days already being exploited in the wild. Buried in that pile was CVE-2026-50522, a deserialization flaw in on-premises SharePoint Server that scored a 9.8 out of 10 on the CVSS scale. For a few days, it looked like just another line item in a very long changelog.
Then a proof-of-concept exploit went public, and everything changed. Within days, researchers were watching real attackers hit real SharePoint servers with it. A closely related flaw in the same family, CVE-2026-58644, turned out to have been exploited as a zero-day before Microsoft had even shipped a fix for it. CISA added CVE-2026-58644 to its Known Exploited Vulnerabilities catalog on July 22 and gave federal agencies a short, hard deadline to patch affected systems or take them offline. That is not the kind of urgency the government hands out for an ordinary bug.
What CVE-2026-50522 Actually Does
SharePoint Server, the on-premises version thousands of businesses run for document management and internal sites, has a .NET deserialization weakness. In plain terms, SharePoint trusts certain incoming data more than it should, and an attacker who is already authenticated as a Site Owner can use that trust to make the server run their own code.
That "already authenticated" part sounds like a mitigating factor until you remember how many organizations reuse weak or default credentials, or have Site Owner accounts nobody has reviewed in years. Getting that first foothold is often the easy part.
Once the attacker has code execution, the real damage starts. Security vendor watchTowr found that attackers are pulling SharePoint's IIS machine keys in a single request. Machine keys are what SharePoint uses to validate and encrypt session data, and if an attacker has yours, they can forge trusted requests to the server going forward, even after you patch the original hole. Patching CVE-2026-50522 closes the door the attacker walked through. It does not remove them if they are already inside holding your keys.
CISA's broader warning covers a cluster of related SharePoint issues tied to the same wave of activity: CVE-2026-56164, a lower-severity privilege escalation bug also being actively exploited, plus CVE-2026-32201 and CVE-2026-45659. Credit for the original discovery of CVE-2026-50522 goes to DEVCORE researcher "splitline," whose research is what got Microsoft moving on a fix in the first place.
Why This One Matters More Than the Average Patch Tuesday
Most CVEs never get exploited. Most exploited CVEs never get a public proof-of-concept. This one has both, plus a discoverable, valuable target since on-prem SharePoint tends to sit on a lot of sensitive internal documents, plus a persistence mechanism that survives patching. That combination is what pushes something from "patch when you get to it" to "patch today."
On-premises SharePoint also tends to live in the part of the network that gets the least attention. Cloud services get monitored. SaaS apps get monitored. The SharePoint server that has been running quietly since 2019 in the corner of the data center, doing its job without complaint, often does not.
What to Actually Do About It
If you are running on-prem SharePoint Server, whether Subscription Edition, 2019, or 2016, here is the order of operations. Patch immediately: apply the July 2026 security updates if you have not already, and do not wait for a maintenance window if the server is internet-facing. Rotate your machine keys, which is the step people skip. watchTowr's advice here is blunt: patching alone is not enough, because a stolen machine key stays valid after the patch goes in, so you need to regenerate the ASP.NET machine keys and recycle the application pool.
Hunt for signs of compromise before assuming you are clean. Look for unusual Site Owner activity, unexpected IIS application pool recycles, and outbound connections from the SharePoint server that do not match its normal behavior. Audit your Site Owner accounts, since the exploit chain starts with an authenticated Site Owner, and reducing the number of accounts with that role, while making sure the ones that remain use strong, monitored credentials, meaningfully shrinks the attack surface. And take the opportunity to ask whether you need on-prem SharePoint at all. This is not the first serious SharePoint RCE, and it will not be the last. If your usage does not require staying on-prem, migrating to SharePoint Online removes an entire category of risk going forward.
The Broader Lesson
Vulnerability management is not just patching when Microsoft tells you to. It is understanding which of your systems are exposed, which ones would hurt the most if compromised, and which ones need continuous monitoring that can catch an attacker even after the patch goes in. CVE-2026-50522 is a good reminder that the gap between disclosure and exploitation keeps shrinking, sometimes to a matter of days.
At AetherGuard Technologies, patch management and vulnerability monitoring are core parts of what we do for managed IT clients. If you are not sure whether your SharePoint environment, or anything else in your infrastructure, is exposed to something like this, that is exactly the kind of question a security assessment is built to answer.
