Microsoft SharePoint RCE Vulnerability CVE-2026-50522 Actively Exploited Post-PoC Release

A critical remote code execution (RCE) vulnerability in Microsoft SharePoint, CVE-2026-50522 (CVSS 9.8), is under active exploitation following the release of a public proof-of-concept (PoC) exploit. Security experts warn that attackers are leveraging this flaw to steal machine keys and maintain persistence, urging immediate credential rotation for affected systems.

A third SharePoint Server flaw patched by Microsoft as part of its Patch Tuesday update for July 2026 has come under active exploitation, per watchTowr.

The vulnerability in question is CVE-2026-50522 (CVSS score: 9.8), a critical deserialization of untrusted data in Microsoft Office SharePoint that could allow an unauthorized attacker to execute code over a network. Microsoft credited DEVCORE

Read original article