SharePoint RCE on KEV; Attackers Pivot to Machine Keys

CISA added CVE-2026-50522 to the Known Exploited Vulnerabilities catalog on July 22, 2026. The critical SharePoint Server deserialization flaw — patched in Microsoft’s July Patch Tuesday — is being actively exploited. If your on-premises SharePoint servers aren’t patched yet, the window closed a long time ago.

There’s a wrinkle, and it matters even if you already patched: BleepingComputer reports that attackers are using the initial RCE to pivot immediately to stealing ASP.NET machine keys from compromised servers. Patching the vulnerability does not rotate your machine keys. If your server was reachable before you patched, you could still have a persistence problem.

What machine keys are and why this matters

Machine keys are cryptographic values stored in IIS configuration that ASP.NET uses to sign and encrypt ViewState, authentication tokens, and other session data. Applications share them across a server farm. If an attacker has your machine keys, they can craft valid authentication tokens for any application on the same IIS instance — no further exploit needed. That’s persistent access that survives a SharePoint patch.

The exploitation pattern here is: gain unauthenticated RCE via CVE-2026-50522, read web.config or access machine key locations, exfiltrate the keys, then use them for continued authenticated access to the server at will.

The vulnerability

CVE-2026-50522 is a deserialization of untrusted data flaw in SharePoint Server, scored CVSS 9.8 (Critical) by NVD. It allows an unauthenticated remote attacker to execute code over the network. Microsoft patched it on July 14, 2026, as part of the July Patch Tuesday release. Discovery credit: DEVCORE.

See the MSRC advisory for CVE-2026-50522 and the NVD record.

What to do — in order

1. Apply Microsoft’s July 2026 SharePoint Server updates if you haven’t. This closes the initial RCE vector.
2. Rotate your ASP.NET machine keys — even if you believe you patched before exposure, rotation is cheap insurance. Any existing forged tokens are invalidated on rotation. Follow Microsoft’s guidance on machine key rotation for SharePoint Server.
3. Audit IIS and SharePoint ULS logs for anomalous POST requests, unexpected code execution activity, or ViewState manipulation before your patch date.
4. Check for secondary persistence — web shells, scheduled tasks, new service accounts, or local user additions are common follow-on steps after RCE on a SharePoint server.

SharePoint Online (Microsoft 365) is not affected — Microsoft handles patching on the service side. This applies only to on-premises SharePoint Server installations.

Priority call

Unpatched on-premises SharePoint Server: patch now, then rotate keys. Patched, but exposure window unknown: rotate keys immediately and audit logs. SharePoint Online: no action required.

For background on this vulnerability and the initial exploitation disclosure, see SharePoint CVE-2026-50522 exploited after public PoC filed yesterday.