SharePoint CVE-2026-50522 exploited: patching is not enough

ColCERT, Colombia’s national CSIRT, has issued alert COLCERT AL-20260804-108 on CVE-2026-50522, a critical vulnerability in on-premises Microsoft SharePoint Server. According to the alert, the flaw is being actively exploited, and the attackers’ goal is not just to get into the server but to stay there: they steal the cryptographic keys SharePoint uses to sign session tokens and use them to keep access even after the patch is installed.

This article relies on a single source, the ColCERT alert (dated 4 August 2026), which in turn cites Microsoft’s advisory, the CISA KEV catalogue, the NVD and a report from the Canadian Centre for Cyber Security (CCCS) shared through the CSIRT Americas network: every statement below is attributed to the Colombian agency.

Timeline

According to ColCERT:

• 14 July 2026: Microsoft fixes the vulnerability in its monthly update, rated “exploitation more likely” but with no known attacks;
• 20 July: a working proof of concept is released and, a few hours later, researchers’ sensor networks record successful exploitation against real servers;
• 22 July: CISA adds the CVE to the KEV catalogue, with a 25 July deadline for US federal agencies;
• 27 July: the CCCS reports the vulnerability to the CSIRT Americas network, with CVSS 9.8 and SSVC rating “Act” (immediate action).

Technical details

• CVE: CVE-2026-50522, CVSS 3.1 9.8 (critical), listed in the CISA KEV catalogue.
• Weakness: deserialization of untrusted data (CWE-502), leading to remote code execution.
• Affected products: SharePoint Server Subscription Edition, SharePoint Server 2019 and SharePoint Server 2016 Enterprise, with builds earlier than the one released on 14 July 2026. On-premises installations only: SharePoint Online and Microsoft 365 are not affected.
• SharePoint 2013 and 2010: out of support. They are not listed as affected because Microsoft no longer assesses them and, ColCERT points out, they will not receive fixes for any vulnerability.
• Privileges obtained: those of the SharePoint service account, usually very broad according to the alert.

Authentication: the sources disagree

ColCERT flags a discrepancy. Microsoft’s advisory describes a network attack by a user authenticated as at least Site Owner. A 9.8 score, however, can only be reached with a vector that requires no privileges; part of the technical coverage describes the flaw as exploitable without authentication and, according to traffic analyses published by independent researchers, the captured attack requests carry no credentials at all. The agency’s conclusion: treat the vulnerability as exploitable without authentication and fix it right away.

The attack chain

The sequence described by ColCERT:

1. the attacker scans the Internet for reachable SharePoint servers, with no need to know the organisation;
2. they send a single HTTP request with tampered serialized data, without credentials, phishing or user interaction;
3. the server deserializes the data and runs the attacker’s commands;
4. with one request the attacker extracts the IIS machine keys, which sign and validate session tokens;
5. with those keys they forge valid tokens, including administrator ones, without exploiting the flaw again;
6. from the compromised server they install malicious .aspx pages, run commands, move to other systems and exfiltrate documents.

The MITRE ATT&CK techniques listed in the alert are T1190 (Exploit Public-Facing Application), T1552.004 (Unsecured Credentials: Private Keys), T1606 (Forge Web Credentials), T1505.003 (Web Shell) and T1059 (Command and Scripting Interpreter, with interpreters launched as child processes of w3wp.exe).

The alert also notes that between April and July 2026 CISA reported exploitation of other SharePoint Server vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644), and that in several cases the follow-up activity was precisely the theft of machine keys. For ColCERT, anyone exposing on-premises SharePoint should check the product’s full update status, not just this CVE, and ask whether Internet exposure is really needed.

Why the patch alone is not enough

The update closes the entry point but does not invalidate keys that have already been stolen: whoever holds them keeps generating tokens the server accepts. That is why ColCERT calls for two steps, both required: first the patch, then rotating the machine keys and restarting IIS on every server in the farm. Without the second step, an attacker who is already inside keeps access while the organisation believes the problem is closed.

Impact for European and Italian companies

The alert is Colombian, but the vulnerability affects any organisation running on-premises SharePoint reachable from the Internet. ColCERT lists government, finance, healthcare, education, industry, transport and IT among the sectors concerned, and among the possible consequences access to documents, theft of credentials and tokens, persistent backdoors, lateral movement and ransomware.

For NIS2 entities, the case concerns the handling of exploited vulnerabilities and compromise assessment: a significant incident must be assessed for notification to the national CSIRT (in Italy, CSIRT Italia at ACN). If the server held personal data, a compromise must also be assessed as a breach under the GDPR. In healthcare, where document platforms often store patient records and files, checking the server’s integrity is not an optional step.

What to do now

ColCERT’s recommendations:

1. Check the build of every server in the farm with Get-SPFarm | Select-Object BuildVersion or from Central Administration, not from the web server header, which the alert says is only approximate.
2. Install the July 2026 cumulative update on all servers in the farm, starting with those exposed to the Internet.
3. Rotate the machine keys and restart IIS on every server after patching.
4. Hunt for indicators of compromise: POST requests to /_trust/default.aspx with large serialized bodies, unauthorised .aspx files created since 20 July, anomalous child processes of w3wp.exe, sessions that remain valid after key rotation.
5. Preserve evidence before cleaning up: IIS logs, Windows event logs and a file system image.
6. Take off the Internet any server that does not need to be published, or publish it only through a VPN or an authenticating reverse proxy, and separate SharePoint servers from the rest of the network.
7. Enable AMSI integration on SharePoint 2016 and 2019.
8. Plan the migration of SharePoint 2013 and 2010; in the meantime, use a WAF, IP allow lists and VPN-only access.

How ARXDOME helps

ARX Expose shows which services your company exposes to the Internet and which have known vulnerabilities, so you know whether a SharePoint server can be reached from outside. ARX Shield lists open vulnerabilities per machine, highlighting those already exploited, and lets you isolate a suspicious server from the network. ARX Sentry collects security events from servers, including suspicious executions, and monitors file integrity in the chosen folders, which helps spot new .aspx pages; with ARX Trace, analysts run collections and searches across all servers in the farm.

Last updated: 9 October 2026