In server rooms across government agencies and enterprises, systems that once hummed quietly in the background have suddenly become targets. Security researchers have tracked attempts to weaponise a flaw in Microsoft SharePoint Server, exposing once again how quickly enterprise software can shift from asset to liability when left unpatched.
The vulnerability, tracked as CVE-2026-50522, stems from unsafe handling of untrusted data during deserialization. An attacker who reaches an exposed SharePoint instance can execute arbitrary code remotely without any authentication. With a CVSS score of 9.8, it sits at the upper end of critical severity. Microsoft included the fix in its July 2026 security updates for on-premises versions covering SharePoint Server 2016, 2019 and the Subscription Edition. SharePoint Online deployments remain unaffected.
Yet the window between patch release and real-world abuse proved narrow. As The Hacker News reported, researchers from watchTowr observed active exploitation against on-premises deployments once public proof-of-concept code became available. The attackers focus on stealing machine keys, a move that grants them persistent access long after the initial breach. Help Net Security noted the same pattern, underscoring how quickly threat actors pivot from disclosure to deployment.
From discovery to catalogue
The flaw was discovered and reported by splitline, a researcher with the DEVCORE team. CISA moved swiftly, adding CVE-2026-50522 to its Known Exploited Vulnerabilities catalogue on 22 July. Federal civilian executive branch agencies now face a binding deadline of 25 July to apply the vendor-supplied mitigations. The catalogue entry leaves little room for delay: organisations must follow Microsoft’s instructions and any relevant binding operational directives.
This episode fits a wider pattern. Complex enterprise platforms accumulate layers of legacy code and integration points that attackers probe relentlessly. The speed with which proof-of-concept material translated into live campaigns highlights the gap between patch availability and actual remediation in many environments. Machine-key theft adds a further complication. Even after organisations apply the update, they must rotate those keys to close off lingering footholds.
Organisations running internet-facing on-premises SharePoint instances are advised to apply patches promptly and rotate machine keys after patching to mitigate persistence risks from key theft.
The contrast between cloud and on-premises risk stands out. While Microsoft’s cloud offering sidesteps this particular weakness, thousands of organisations still rely on self-hosted servers that face the public internet. Their exposure reflects decisions made years ago about infrastructure ownership, cost and control. Those choices now carry immediate operational weight.
