Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC

A critical remote code execution vulnerability in Microsoft SharePoint Server, CVE-2026-50522 (CVSS 9.8), is being actively exploited in the wild following the release of a public proof-of-concept exploit. The flaw, a deserialization of untrusted data, allows an unauthenticated attacker to execute arbitrary code over a network. Microsoft credited DEVCORE researcher ‘splitline’ for discovering the issue. watchTowr reported that attackers are using the exploit to steal SharePoint machine keys with a single request, enabling persistent access. Defused Cyber observed threat actors delivering .NET deserialization payloads to SharePoint sign-in endpoints without authentication. CISA has warned that multiple SharePoint Server vulnerabilities, including CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644, are being exploited to gain unauthorized access to on-premises instances. These flaws affect all supported on-premises SharePoint Server versions (Subscription Edition, 2019, and 2016) and involve remote code execution, IIS machine key theft, and deserialization techniques for persistence and malware deployment. Defenders are urged to patch immediately and rotate credentials on potentially exposed assets.