Vulnerability record · CVE-2026-50522 · published 14 July 2026
CVE-2026-50522: Microsoft SharePoint deserialization flaw allows remote code execution
Microsoft · Sharepoint Server
Microsoft SharePoint Server deserializes untrusted data, letting an unauthorized attacker run code over the network. The flaw is remotely reachable with no privileges or user action, and it is listed in CISA's Known Exploited Vulnerabilities catalog, so it is being exploited in the wild.
Description
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated network code execution with a 9.8 CVSS score, active KEV listing and very high EPSS probability.
What it is
Microsoft SharePoint Server deserializes untrusted data, letting an unauthorized attacker run code over the network. The flaw is remotely reachable with no privileges or user action, and it is listed in CISA's Known Exploited Vulnerabilities catalog, so it is being exploited in the wild.
Impact
An unauthenticated attacker can execute arbitrary code on the SharePoint server, giving full control of the host and any data or credentials it can reach.
Attack surface
Reachable over the network via the SharePoint service; the CVSS vector shows no authentication (PR:N) and no user interaction (UI:N) required.
Exploitation
Listed in CISA KEV with a 2026-07-25 remediation due date, and EPSS 30-day probability is 0.854 (99.7th percentile), indicating active exploitation.
What to do
- Apply the Microsoft patch from the MSRC update guide immediately; this is the primary fix.
- If patching is not possible, follow CISA BOD 26-04 guidance and vendor mitigations, or discontinue use of the exposed product.
- Remove internet exposure from SharePoint servers until patched, restricting access to trusted networks.
- Run CISA's forensics triage requirements on any internet-facing SharePoint host to check for compromise.
- Audit service accounts and credentials used by SharePoint in case of prior exploitation.
Detection
- Hunt for unexpected child processes spawned by SharePoint worker processes (w3wp.exe, SharePoint timer service).
- Monitor for suspicious deserialization payloads or anomalous POST requests to SharePoint endpoints in web and IIS logs.
- Alert on outbound network connections from SharePoint servers to unfamiliar hosts.
- Review file writes and new binaries in SharePoint web directories and temp paths.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2026-50522 to the Known Exploited Vulnerabilities catalog on 22 July 2026 as "Microsoft SharePoint Deserialization of Untrusted Data Vulnerability ". Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal deadline 25 July 2026.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522 | PatchVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50522 | US Government Resource |
Track CVE-2026-50522 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2026-50522), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
