A recently exposed vulnerability, identified as CVE-2026-50522, is causing concern among enterprise IT departments. This critical flaw allows attackers to execute code remotely on Microsoft SharePoint servers that are on-premises, without requiring authentication.
Understanding the Vulnerability
This vulnerability has been assigned a critical CVSS score of 9.8, highlighting its severity. It is related to the deserialization of untrusted data, a recurring issue for SharePoint in 2026. The flaw affects x64 deployments of Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, making these systems particularly vulnerable.
An attacker can exploit this flaw by sending a specially crafted serialized object to a vulnerable endpoint, initiating arbitrary code execution in the server’s context. This can potentially lead to a full server takeover, deployment of malicious web shells, theft of sensitive application data, and unauthorized lateral movement across networks.
Active Exploitation and Risks
There are reports of active exploitation in the wild, particularly related to a companion vulnerability, CVE-2026-58644, which requires the attacker to have at least Site Owner permissions. However, CVE-2026-50522 does not have such a requirement, enhancing its risk profile. Though not yet confirmed as exploited, its EPSS score of approximately 19.7% suggests significant near-term risk.
Security researchers have detected an undocumented .NET deserialization payload targeting SharePoint sign-in endpoints, devoid of authentication material. This activity aligns more with the characteristics of CVE-2026-50522, necessitating a reassessment of its potential exploitation.
Protective Measures and Recommendations
It is crucial for organizations to apply Microsoft’s July 2026 security update across all SharePoint systems to mitigate this vulnerability. Any inconsistencies in patching can leave systems exposed to exploitation. Unsupported versions of SharePoint should be retired or upgraded to receive necessary security updates.
Organizations should also monitor for unusual activity at sign-in endpoints, especially unauthenticated deserialization payloads that deviate from known patterns. Reducing internet exposure of on-premises SharePoint servers is advised, given the thousands of vulnerable servers still exposed, as noted by Shadowserver.
Finally, reviewing CISA’s Known Exploited Vulnerabilities catalog is recommended, as it includes CVE-2026-58644, emphasizing the need for vigilance against these threats.
