Vulnerabilities · 54 days ago
Patching SharePoint is no longer the whole job. Attackers are using CVE-2026-50522 to take IIS machine keys, so a fixed server can stay trusted long after the code flaw is closed.
CERT-EU and WatchTowr say the exploitation is happening on on-prem SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. The new risk is not just code execution on the server; it is theft of the signing material that lets an attacker keep minting requests that look legitimate.
Microsoft has already shipped the fix, but the trust loss can outlast it. If those keys were exposed, the server may be patched and still under the attacker’s control until the signing secrets are rotated and the compromise is assessed.
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over… Microsoft patch: 5002891.
Patch available KB5002891 Download →
CISA federal remediation date Jul 25
14 sources covering this story
Attackers are exploiting an unauthenticated SharePoint RCE vulnerability (CVE-2026-50522) to extract the servers' IIS machine keys.
Fourth SharePoint Vulnerability Exploited in Past Month’s Wave of Attacks
CVE-2026-50522 is being exploited by threat actors to steal machine keys and retain long-term access.
Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC
watchTowr reports active exploitation of SharePoint CVE-2026-50522 after a public PoC, with attackers stealing machine keys for persistence.
Critical SharePoint RCE flaw exploited to steal machine keys
Hackers are actively exploiting the critical CVE-2026-50522 vulnerability in Microsoft SharePoint to steal machine keys and maintain access even after affected servers are patched.
Microsoft SharePoint under attack via new exploit
Security researchers warn the potential risk could rival the widespread ToolShell campaign of 2025.
On July 14, 2026, Microsoft published a security advisory addressing CVE-2026-58644, a critical remote code execution (RCE) vulnerability affecting on-premises Microsoft SharePoint Server deployments.
CISA Mandates Urgent Patch for Actively Exploited Fortinet Flaws
US government agencies have until July 19 to patch two critical Fortinet vulnerabilities
Fresh SharePoint Vulnerability Exploited Soon After Disclosure
The critical-severity security defect allows remote, authenticated attackers to execute arbitrary code on the server.
SharePoint CVEs FAQ: CVE-2026-56164, CVE-2026-32201, CVE-2026-45659 | Tenable®
CISA confirmed exploitation of three SharePoint Server CVEs.
Aggiornamenti Mensili Microsoft
Microsoft ha rilasciato gli aggiornamenti di sicurezza mensili che risolvono un totale di 622 nuove vulnerabilità, di cui 2 di tipo 0-day.
CISA urges immediate SharePoint hardening as exploits mount
Three actively exploited SharePoint vulnerabilities have landed in the KEV catalog, with security experts warning that patching alone won’t prevent business disruption.
Part of the PlainSec briefing for 2026-07-26