SharePoint Alert: A Critical Vulnerability Exposes Machine Keys. Microsoft Releases the Fix

A critical vulnerability in on-premise SharePoint servers is under active exploitation, allowing attackers to steal the machine keys of compromised environments. The vulnerability, identified as CVE-2026-50522, enables remote code execution without the need for authentication, and Microsoft has only fixed it with the July 2026 security updates.

The problem, classified as deserialization of untrusted data, adds to an already heavy list. CISA had recently reported three other actively exploited SharePoint vulnerabilities, and researchers have now identified targeted attacks against this fourth flaw, despite a fix already being available.

The most critical point concerns the machine keys, the credentials SharePoint uses to generate and validate internal authentication tokens. Whoever manages to steal them can forge valid tokens, impersonate legitimate users, and access company sites and documents with their own privileges. Installing the patch, in this case, is not enough to close the door: stolen keys continue to validate forged tokens even after the server is updated, ensuring attackers a persistence that survives the official fix.

Public Exploit, Attacks Started Within Hours: Microsoft Fixes the Flaw

Researchers at watchTowr observed the first attempts at exploitation just days after the publication of a working proof-of-concept, which occurred on July 20. The company's honeypot network, dubbed Attacker Eye, recorded successful compromises of SharePoint servers within hours of the technique's dissemination.

Defused, a company specialized in threat intelligence, had already intercepted an undocumented deserialization vector starting from July 17 but initially failed to link it to a specific CVE. Only later was the observed activity likely traced back to CVE-2026-50522, indicating that the attacks had started even before the public disclosure of the PoC.

An undocumented SharePoint deserialization vector is being exploited on our honeypots during the current SharePoint CVE wave. An actor is delivering a .NET deserialization payload to a SharePoint sign-in endpoint that matches no published PoC. We are not assigning a CVE and pic.twitter.com/oLcgIIoXnw
— Defused (@DefusedCyber)
July 17, 2026

The publicly circulating PowerShell exploit on GitHub, crafted by the researcher known as Janggggg, targets a SharePoint deserialization path to achieve code execution on the server. The mechanism exploits sending a forged authentication token containing a malicious .NET payload based on BinaryFormatter to the login endpoint /_trust/default.aspx via a spoofed WS-Federation response. Since it is a flaw that does not require credentials, any exposed SharePoint server on the network becomes a reachable target without preliminary obstacles.

Organizations managing on-premise SharePoint installations should promptly install the latest security updates released by Microsoft. However, the patch only closes the entry flaw: it does not revoke authentication tokens or machine keys that may have already been stolen prior to the remedial action.

Administrators with potentially exposed servers must therefore rotate the machine keys and the associated credentials, in addition to checking for unauthorized accesses, malicious payloads, or other signs of persistence on the affected systems. A simple update, on its own, risks leaving the service door wide open to those who have already entered beforehand.