Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability (CWE-502) that allows an unauthenticated attacker to execute arbitrary code over a network, with no user interaction required. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), and Microsoft has assessed it as "Exploitation More Likely."

A working exploit for this vulnerability was first demonstrated at Pwn2Own Berlin and provided to Microsoft ahead of a fix. Despite this responsible disclosure, active in-the-wild exploitation only began after a public proof-of-concept was released on 20 July 2026, with successful attacks against internet-facing, unpatched on-premises SharePoint servers observed within hours. CVE-2026-50522 is the fourth SharePoint Server vulnerability confirmed under active exploitation in the current wave, alongside CVE-2026-32201 (addressed in CERTVU Advisory 137), CVE-2026-45659, CVE-2026-56164 and CVE-2026-58644.

The vulnerability affects the following on-premises Microsoft products (this does not affect SharePoint Online / Microsoft 365):

• Microsoft SharePoint Enterprise Server 2016 (x64-based System) – Version affected: builds earlier than 16.0.5561.1001
• Microsoft SharePoint Server 2019 (x64-based System) – Version affected: builds earlier than 16.0.10417.20175
• Microsoft SharePoint Server Subscription Edition (x64-based System) – Version affected: builds earlier than 16.0.19725.20434
• Microsoft SharePoint Online (M365 cloud) – Not affected; patched automatically by Microsoft

Exploitation is network-based, requires no authentication, and requires no user interaction.

• Step 1 - Target Identification The attacker locates internet-facing or internally exposed on-premises SharePoint servers.
• Step 2 - Malicious Sign-In Request A crafted WS-Federation sign-in response containing a forged SecurityContextToken is submitted to the SharePoint /_trust/default endpoint.
• Step 3 - Deserialization and Code Execution The token's cookie value carries a malicious .NET BinaryFormatter payload. SharePoint deserializes it without validating authenticity, executing attacker-supplied code in the context of the IIS worker process (w3wp.exe).
• Step 4 - Machine Key Theft With code execution established, attackers extract the server's IIS machine keys (validationKey and decryptionKey) from web.config in a single follow-up request.
• Step 5 - Persistent, Re-authenticated Access Using the stolen machine keys, attackers can forge valid authentication tokens (e.g. ViewState/session tokens) and regain access to the server even after the underlying vulnerability has been patched, unless the keys themselves are also rotated.

CERTVU recommends the following:

• Apply Microsoft's July 2026 security update for CVE-2026-50522 immediately across all on-premises SharePoint farm servers (Enterprise Server 2016, Server 2019, Subscription Edition). This vulnerability is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 22 July 2026, federal remediation due date 25 July 2026).
• Patching alone is not sufficient. Any SharePoint server that was internet-facing or otherwise exposed before patching should have its IIS machine keys (validationKey and decryptionKey) rotated, per Microsoft's guidance, since a stolen machine key survives the patch.
• Review IIS and SharePoint ULS logs for requests to the /_trust/default endpoint and for anomalous child processes spawned by w3wp.exe, which may indicate prior exploitation.
• Restrict direct internet exposure of on-premises SharePoint servers where feasible, and apply network segmentation or WAF rules pending confirmation that all farm servers are patched.
• Confirm patch status against the full current SharePoint exploitation wave - CVE-2026-32201 (CERTVU Advisory 137), CVE-2026-45659, CVE-2026-56164 and CVE-2026-58644 - not this CVE in isolation.