A critical vulnerability in Microsoft SharePoint is being actively exploited by hackers to steal machine keys and maintain long-term access to compromised systems. This flaw, known as CVE-2026-50522, was addressed in July’s security updates from Microsoft, but it appears that attackers have already begun leveraging it against vulnerable on-premise deployments.
The vulnerability itself is a deserialization-of-untrusted-data flaw that allows a remote attacker to execute code over a network without authentication. This means that an attacker can send malicious data to a SharePoint server, which would then process the data and execute the malicious code. The exploit takes advantage of a specific endpoint in SharePoint’s WS-Federation sign-in response, allowing the attacker to deliver a malicious payload that results in arbitrary code execution on the server.
According to security researchers at watchTowr, hackers started exploiting CVE-2026-50522 immediately after a valid proof-of-concept (PoC) exploit became public. Within hours of the PoC being released, watchTowr’s global honeypot network detected exploitation attempts that successfully compromised target systems. The attackers are stealing machine keys, which would allow them to maintain long-term access on breached systems.
The fact that this vulnerability is being actively exploited so soon after the PoC exploit was made public highlights the importance of keeping software up-to-date and implementing robust security measures. Even if a patch has been applied, it’s essential to consider any potential exposure during the window between patch release and widespread adoption.
In this case, watchTowr advises defenders not only to apply the latest SharePoint security updates but also to rotate credentials on any asset that may have been exposed. This is crucial in preventing attackers from using stolen machine keys to maintain access to compromised systems. Security teams must stay vigilant and test every layer of their defenses before an attacker does.
The rapid exploitation of CVE-2026-50522 serves as a reminder that vulnerabilities can be quickly leveraged by malicious actors, emphasizing the need for proactive security measures and vigilance in monitoring and responding to potential threats. By staying informed about emerging vulnerabilities and implementing robust security practices, organizations can minimize their exposure to attacks like this one.
Source: Bleeping Computer — 2026-07-21