SharePoint CVE-2026-50522 exploited after public PoC

Confirmed reporting by watchTowr via The Hacker News, 2026-07-21. CVE-2026-50522, a critical deserialization flaw in Microsoft SharePoint Server, is under active exploitation one week after Microsoft’s July 14 patch. CVSS 9.8. Unauthenticated network RCE. Microsoft credits DEVCORE for the disclosure. watchTowr reports exploitation followed the circulation of a public proof-of-concept. Confidence on exploitation: high, per watchTowr’s own labeling.

Timeline

• 2026-07-14. Microsoft ships the July Patch Tuesday updates. CVE-2026-50522 is one of three SharePoint Server RCEs addressed in the same cycle, alongside credit to DEVCORE. See the MSRC entry.
• Week of 2026-07-14. A public proof-of-concept surfaces. watchTowr characterizes it as sufficient to drive exploitation attempts; the vendor advisory does not walk the trigger and this piece will not either.
• 2026-07-21. watchTowr publishes the active-exploitation determination, carried by The Hacker News the same day.

Seven days from patch to observed exploitation. That is the compressed n-day-to-n-hour cycle The Hacker News wrote about earlier today, playing out in real time on the same platform Microsoft already patched twice this month.

What the flaw is

Deserialization of untrusted data in Microsoft Office SharePoint, reachable over the network by an unauthenticated attacker, culminating in code execution. NVD scores it 9.8 under CVSS 3.1 — Critical. Microsoft’s severity assessment aligns.

The class is familiar. SharePoint’s server-side handling of serialized input has produced multiple RCEs across the last several patch cycles, including CVE-2026-45659, the SharePoint deserialization bug CISA added to the KEV catalog on July 2 and separate from the current flaw. What is new is not the mechanism. What is new is the compressed window.

This piece does not reproduce exploit specifics. Readers who need the mechanics should read the MSRC vulnerability entry and the NVD record directly.

Exposure

SharePoint Server — the on-premises product — is the exposed surface here. SharePoint Online is Microsoft-operated and outside the scope of this advisory. Public search-engine indexes routinely count on-prem SharePoint deployments in the tens of thousands worldwide; the fraction still unpatched a week past Patch Tuesday, on a flaw with a public PoC, is not knowable from the outside but is not zero.

The KEV precedent from earlier this month sets the pattern. CVE-2026-45659, the prior SharePoint deserialization bug, reached CISA KEV within weeks of active exploitation. CVE-2026-50522 has the same profile and the same class. A KEV addition in the near term is plausible but not confirmed. Confidence: low, that is a forecast, not a reported fact.

What actually changes today

The patch shipped seven days ago. If the SharePoint farm took it, this article is not about you. If it did not:

• Get the July 14 SharePoint security update on the farm. Microsoft’s MSRC entry enumerates the applicable builds per SharePoint edition. Confirm the patch is applied on all front-end servers, not just one.
• Treat any on-prem SharePoint that was reachable and unpatched during the week of 2026-07-14 through 2026-07-21 as in-scope for hunt. watchTowr’s public exploitation call means attempts were happening while unpatched boxes were on the wire. Pull IIS logs from the SharePoint front-ends, correlate against unexpected process spawns under the w3wp.exe context, and look for the follow-on activity SharePoint compromises commonly show — webshell drops into the _layouts/ or _vti_bin/ paths, unauthenticated posts to serialization endpoints, and lateral movement out of the SharePoint service account.
• Rotate credentials the SharePoint app pool and service accounts have access to. Deserialization RCEs land as the SharePoint service account and everything reachable from there is in scope.
• Do not wait for KEV or a specific victim disclosure. watchTowr’s confidence labeling (“active,” “exploited”) is an operational signal now, not a courtroom standard.

What is still unconfirmed

• Victim identities. watchTowr did not publish victim names in the material summarized by The Hacker News.
• Threat-actor attribution. No named crew reported yet. Prior SharePoint deserialization flaws have drawn a mix of ransomware operators and data-extortion groups; see our Helix coverage for one contemporary example, though that was a different access vector.
• The exploit chain itself. Neither the MSRC entry, the NVD record, nor the public watchTowr summary carried by The Hacker News walks the trigger. This piece does the same.
• KEV catalog status. Not on CISA KEV as of publication. Prior-cycle SharePoint deserialization RCEs reached KEV within weeks; treat that as pattern, not prediction.

Sourcing

• The Hacker News: Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC — 2026-07-21
• Microsoft MSRC: CVE-2026-50522 vulnerability entry
• NVD: CVE-2026-50522
• CISA: Known Exploited Vulnerabilities catalog
• Related: SharePoint RCE CVE-2026-45659 KEV addition, Helix SharePoint vishing crew, wp2shell mass-scanning triage