A critical vulnerability in Microsoft SharePoint is being actively exploited by hackers to steal machine keys and maintain access even after affected servers are patched. The flaw, known as CVE-2026-50522, allows remote attackers to execute code on vulnerable systems without authentication. This can be done by delivering a malicious payload through a specially crafted security token, which, if processed by the SharePoint server’s deserialization path, results in arbitrary code execution.
The vulnerability was patched in Microsoft’s July security updates, but watchTowr, an offensive security company, has observed hackers leveraging it to compromise on-premise SharePoint deployments. In fact, within hours of a valid proof-of-concept (PoC) exploit becoming public, watchTowr’s global honeypot network detected exploitation attempts using this PoC that successfully compromised target systems.
What makes this vulnerability particularly concerning is that attackers are stealing machine keys, which allow them to maintain long-term access on breached systems. This means that even after the vulnerable server has been patched, hackers can still use the stolen machine key to impersonate users and access sensitive resources with elevated privileges.
According to Defuse, an early warning threat intelligence company, similar attacks were detected as early as July 17, but it was unclear if these incidents were related to a specific vulnerability. Yesterday, however, the company confirmed that the attacks were likely driven by exploiting CVE-2026-50522.
A PowerShell demonstrative exploit for this vulnerability is publicly available on GitHub from security researcher Janggggg. The PoC attempts to trigger remote code execution by delivering a malicious .NET ‘BinaryFormatter’ payload as the cookie of a forged ‘SecurityContextToken’ within a WS-Federation sign-in response posted to SharePoint’s ‘_trust/default.aspx’ endpoint.
While applying the latest SharePoint security updates will remove the vulnerability, watchTowr advises defenders to also rotate credentials on any asset that may have been exposed. This is a critical step in preventing hackers from maintaining access even after the patch has been applied.
The fact that this vulnerability was patched just a few weeks ago highlights the importance of timely patching and regular security updates. It also underscores the need for vigilant monitoring and proactive threat hunting to detect and respond to emerging threats before they can cause significant damage. As a reminder, security teams should be aware of their systems’ vulnerabilities and test every layer of their defenses regularly to stay ahead of attackers.
In practical terms, this means that organizations using SharePoint should take immediate action to patch their servers and rotate credentials on any affected assets. Additionally, they should review their security protocols to ensure that all layers of defense are adequately tested and configured to detect potential threats. By taking these steps, organizations can minimize the risk of falling victim to attacks leveraging CVE-2026-50522 or other emerging vulnerabilities.
Source: Bleeping Computer — 2026-07-21