Executive Summary
CVE-2026-50522 is a critical remote code execution vulnerability (CWE-502) in Microsoft SharePoint Server with a CVSS score of 9.8. The flaw allows an unauthenticated attacker to execute arbitrary code in the context of the SharePoint service account by sending a crafted serialized payload to SharePoint’s WS-Federation sign-in endpoint. Microsoft patched the vulnerability on July 14, 2026 as part of Patch Tuesday. A public proof-of-concept followed quickly, and active exploitation against on-premises SharePoint deployments was confirmed within days.
CISA added CVE-2026-50522 to the Known Exploited Vulnerabilities catalog on July 22, 2026, with a mandatory remediation deadline of July 25, 2026 for federal agencies. The urgency is compounded by the fact that attackers are actively using exploitation to exfiltrate SharePoint machine keys, which enables persistent unauthorized access that survives the initial infection even after patching.
Affected Versions
The vulnerability affects on-premises SharePoint Server deployments:
- SharePoint Server Subscription Edition
- SharePoint Server 2019
- SharePoint Server 2016 Enterprise
SharePoint Online (Microsoft 365) is not affected. Organizations running SharePoint exclusively through Microsoft’s cloud service have no exposure.
Vulnerability Details
The vulnerability is rooted in SharePoint’s handling of WS-Federation passive sign-in requests processed by /_trust/default.aspx, a legacy authentication endpoint used for claims-based authentication with federated identity providers. The endpoint deserializes a SecurityContextToken embedded in sign-in responses using .NET’s BinaryFormatter class.
BinaryFormatter is notoriously dangerous — it deserializes arbitrary .NET object graphs without type restrictions, which means an attacker can craft a serialized payload that, when deserialized, triggers gadget chains in the .NET framework to execute arbitrary code. Microsoft deprecated BinaryFormatter in .NET 5 and disabled it by default in .NET 7 due to these inherent risks, but SharePoint’s claims authentication infrastructure predates these changes and was still invoking it in the vulnerable code path.
The attack structure is:
- An attacker sends an HTTP POST to
/_trust/default.aspxwith a crafted WS-Federation response body. - The
SecurityContextTokenwithin the response is passed to the deserializer. - The malicious .NET gadget chain executes during deserialization.
- Code runs in the context of the SharePoint application pool service account, which typically has significant local system privileges and file system access.
The critical distinction from many prior SharePoint RCE vulnerabilities is that this does not require authentication. Older SharePoint deserialization bugs (including CVE-2024-38094 and CVE-2026-58644) required at minimum authenticated access, reducing the real-world attack surface. CVE-2026-50522 requires only network reachability to the SharePoint server.
Observed post-exploitation activity focuses on machine key extraction. SharePoint’s machineKey values (validationKey and decryptionKey from web.config) are used to sign and decrypt authenticated tokens. Possession of these keys enables an attacker to forge valid SharePoint authentication tokens indefinitely, maintaining unauthorized access even after the vulnerability is patched and password resets are performed. Security researchers from Bleeping Computer observed attackers retrieving machine keys via a single crafted request in the active exploitation samples.
Exploitation in the Wild
Exploitation began rapidly after public PoC release. The PoC delivers a malicious .NET BinaryFormatter payload disguised as a SecurityContextToken within a WS-Federation sign-in response, posted to the /_trust/default.aspx endpoint. Attack traffic shows no authentication material in the requests, confirming the unauthenticated exploitation path.
Targeting has focused on on-premises SharePoint deployments, consistent with the attack surface (SharePoint Online is not affected). On-premises SharePoint remains common in regulated industries, government, law firms, and enterprises with data sovereignty requirements — high-value targets with sensitive document repositories.
No specific threat actor group has been publicly attributed to the active exploitation campaign at time of writing. The speed of exploitation following PoC publication is consistent with opportunistic scanning rather than targeted intrusion, suggesting broad spray-and-pray campaigns alongside more targeted operations.
The combination of unauthenticated access and machine key theft makes this particularly damaging. Machine keys extracted from a compromised SharePoint instance can be used to generate forged authentication cookies that impersonate any SharePoint user, including site collection administrators, creating a persistent access capability that requires key rotation to eliminate.
Patch and Remediation
Apply the July 2026 Patch Tuesday security updates for your SharePoint version immediately:
- SharePoint Server Subscription Edition: July 2026 cumulative update
- SharePoint Server 2019: July 2026 security update (KB reference in Microsoft Security Update Guide at msrc.microsoft.com)
- SharePoint Server 2016: July 2026 security update
Microsoft’s guidance explicitly states that patching alone is insufficient for potentially compromised systems. Organizations should:
Rotate machine keys. If there is any possibility that /_trust/default.aspx has received malicious requests, regenerate the SharePoint machineKey values (validationKey and decryptionKey) in web.config. This invalidates any forged tokens created using the old keys. Note that key rotation will invalidate all existing SharePoint authentication sessions.
Review WS-Federation configuration. If federated authentication via /_trust/default.aspx is not in active use, consider disabling or restricting access to the endpoint as an additional compensating control, pending patching.
Rotate credentials. Audit and rotate credentials for the SharePoint application pool service account, local administrators on SharePoint servers, and any accounts the service account could have accessed during a potential compromise window.
For organizations unable to apply the patch immediately, network-level blocking of external access to /_trust/default.aspx is the most effective interim control.
Detection
Web server logs: Look for POST requests to /_trust/default.aspx from unexpected source addresses or with unusual payload sizes. Legitimate WS-Federation traffic from configured trusted identity providers should be identifiable; anything outside that baseline warrants investigation.
Windows Event Log / SharePoint ULS logs: Unexpected application pool crashes, ASP.NET deserialization exceptions in SharePoint ULS trace logs, or unusual process spawning from the SharePoint application pool (w3wp.exe launching cmd.exe or PowerShell) are indicators of exploitation.
Machine key access: Look for file system reads of web.config by the IIS worker process from unexpected contexts, or monitoring of the SharePoint web.config file itself for unauthorized reads. Attackers extracting machine keys need to read this file.
Network IOCs: As of CISA’s KEV listing, no specific attacker infrastructure IOCs have been publicly released. Censys and Shodan data indicates significant numbers of publicly exposed on-premises SharePoint servers. Organizations should check their exposure and correlate with inbound request logs.
Post-exploitation hunting: If machine key compromise is suspected, search SharePoint authentication logs for sessions with unusual activity patterns (new user agents, unusual source geographies, high-volume document access) that may indicate forged token use. SharePoint ULS logs record authenticated user context for most operations.
Microsoft has a dedicated SharePoint forensics section in its incident response guidance. CISA’s BOD 26-04 forensics triage requirements apply to federal agencies and represent a reasonable baseline for any organization investigating potential exploitation.