# SharePoint's Machine Key Problem: CVE-2026-50522 Is Being Exploited Now
## The Threat
Microsoft patched CVE-2026-50522 last week as part of July 2026 Patch Tuesday. Less than a week later, watchTowr confirmed active exploitation in the wild — triggered, almost certainly, by the release of a public proof-of-concept exploit. The vulnerability is a deserialization of untrusted data flaw in Microsoft Office SharePoint Server that allows remote code execution without requiring significant attacker knowledge or complex preconditions. It earned a CVSS score of 9.8, and Microsoft's own exploitability assessment tagged it as "Exploitation More Likely" at disclosure — a label that, in retrospect, was understating the urgency.
What makes the active exploitation particularly dangerous isn't just the RCE capability — it's what attackers are doing with it. WatchTowr reports that threat actors are extracting SharePoint machine keys via a single HTTP request. Machine keys are the cryptographic material SharePoint uses to sign and verify serialized data objects. Once an attacker possesses them, they can forge ViewState tokens and maintain persistent, durable access to the server — persisting long after credentials are rotated or user accounts are disabled. Patching the CVE closes the door; it does not revoke the key the attacker already walked away with.
There's also a significant discrepancy in the picture that defenders need to understand. Microsoft's advisory describes the attack requiring an attacker "authenticated as at least a Site Owner." Defused Cyber's forensic analysis of captured exploit traffic tells a different story: the observed requests carry no authentication material whatsoever, consistent with an unauthenticated attack profile. Whether this reflects a pre-auth bypass chained with the deserialization bug, or a difference in attack variants in the wild, the practical implication is the same — assume your unauthenticated surface is exposed.
## Severity and Impact
| Field | Detail |
|---|---|
| CVE | CVE-2026-50522 |
| CVSS Score | 9.8 (Critical) |
| CVSS Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CWE | CWE-502 — Deserialization of Untrusted Data |
| Attack Vector | Network (remotely exploitable, internet-facing) |
| Attack Complexity | Low — no prior system knowledge required, repeatable exploitation |
| Authentication Required | Contested — Microsoft advisory says Site Owner; observed exploit traffic shows no auth material |
| Impact | Remote code execution; machine key theft; persistent access; malware deployment |
| Exploitability Assessment | Exploitation More Likely (Microsoft); active exploitation confirmed (watchTowr) |
| Discovered By | "splitline," DEVCORE Research Team |
## Affected Products
All supported on-premises SharePoint Server versions are affected:
SharePoint Online (Microsoft 365 cloud) is not affected — this is exclusively an on-premises issue.
## Mitigations
Patch immediately. The July 2026 Patch Tuesday update addresses CVE-2026-50522. Given active exploitation is confirmed, there is no acceptable window for delayed deployment.
Rotate machine keys regardless of patch status. WatchTowr explicitly states that patching alone is insufficient for organizations that may have been exposed. If your SharePoint instance was internet-accessible before you patched, treat your machine keys as compromised. Rotate them and invalidate any sessions or tokens that may have been forged using the stolen material.
Hunt for post-exploitation activity. Review IIS logs for anomalous POST requests to SharePoint sign-in endpoints, particularly requests with no authentication material that nonetheless trigger deserialization activity. Defused Cyber's telemetry shows .NET deserialization payloads being delivered to sign-in endpoints — look for unexpected process spawns from SharePoint application pools (w3wp.exe spawning PowerShell, cmd.exe, or network tools).
Network segmentation. On-premises SharePoint instances should not be directly internet-reachable without a reverse proxy or WAF in front of them. If yours is, implement IP allowlisting or require VPN access as an emergency compensating control while you complete patching and key rotation.
Monitor for CISA-flagged campaigns. CISA has separately warned of coordinated exploitation of multiple SharePoint vulnerabilities — CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644 — targeting on-premises instances for RCE, machine key theft, and malware deployment. CVE-2026-50522 joins that list. This is not a single opportunistic actor; treat it as a sustained campaign against on-prem SharePoint infrastructure.
## References
---
## HackWire Analysis
CVE-2026-50522 is the third SharePoint Server vulnerability in active exploitation this month alone — CVE-2026-56164 and CVE-2026-58644 were already being weaponized as zero-days before Microsoft shipped patches for them in July. That's not a coincidence or bad luck. It's a sustained, coordinated offensive against on-premises SharePoint deployments, and the pattern deserves more attention than it's getting.
On-premises SharePoint is legacy infrastructure in the Microsoft ecosystem, increasingly sidelined in favor of SharePoint Online. That positioning creates a dangerous maintenance gap: organizations running on-prem instances often have slower patch cadences, reduced monitoring, and security teams whose attention has shifted toward cloud-native risks. Attackers have noticed. The machine key extraction technique being used here isn't new — it's been a known post-exploitation path for years — but it's being operationalized at scale because the targets are soft.
The authentication discrepancy is the detail that should most concern defenders. If active exploitation traffic carries no authentication material while Microsoft's advisory describes a post-authentication attack path, one of two things is true: either there's a chained pre-auth component that isn't fully characterized yet, or there are multiple exploit variants in the wild with different authentication requirements. Neither interpretation is reassuring. Security teams assessing exposure should not anchor on the "Site Owner authentication required" framing as a meaningful barrier — real-world exploit traffic doesn't appear to respect it.
The machine key theft angle also has a longer tail than straightforward RCE. An attacker who steals your machine keys owns a signing oracle. They can create legitimate-looking authenticated requests, forge ViewState tokens, and maintain access through future patches and password resets. The remediation work here extends well beyond applying the July CU. Treat any exposed on-prem SharePoint instance as fully compromised until key rotation is verified and log forensics are complete.
— HackWire Editorial
---
## Related Coverage