SharePoint Server deserialization of untrusted data RCE
Critical deserialization flaw in Microsoft Office SharePoint Server, CVSS 9.8, allowing an unauthenticated attacker to execute code over a network. Patched July 2026.
- Vendor
- Microsoft
- Product
- SharePoint Server
- CVSS
- 9.8
- EPSS (exploit probability)
- 3.0%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-50522 being exploited?
Yes. CISA added CVE-2026-50522 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 3.0% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-50522 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
Microsoft patched CVE-2026-50522 on July 14, 2026, as part of the July Patch Tuesday release. It is the third SharePoint Server remote-code-execution flaw addressed in that same cycle. Microsoft credits DEVCORE for the discovery.
The vulnerability class is deserialization of untrusted data, reachable over the network without authentication. NVD scores it 9.8 (Critical) under CVSS 3.1.
Active exploitation was reported by watchTowr on 2026-07-21, following the circulation of a public proof-of-concept. CISA added CVE-2026-50522 to the Known Exploited Vulnerabilities catalog on July 22, 2026.
Attackers are using the initial RCE to steal ASP.NET machine keys from compromised servers — patching the vulnerability does not rotate those keys. Affected organizations should patch AND rotate machine keys. See SharePoint RCE on KEV; Attackers Pivot to Machine Keys for remediation steps.
For background on initial exploitation: SharePoint CVE-2026-50522 exploited after public PoC.
Remediation is Microsoft’s July 2026 SharePoint security updates. See the MSRC entry for CVE-2026-50522 and the NVD record.
Other Microsoft SharePoint CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerabilitywrite-up | [ HIGH ] | 8.8 | 9.9% | |
| CVE-2026-55040 SharePoint Server JWT token authentication bypasswrite-up | [ CRITICAL ] | 9.1 | 69.5% | |
| CVE-2026-58644 Microsoft SharePoint deserialization of untrusted data (unauth RCE)write-up | [ CRITICAL ] | 9.8 | 15.9% | |
| CVE-2026-56164 SharePoint Server elevation of privilege — missing authentication for critical functionwrite-up | [ MEDIUM ] | 5.3 | 27.3% | |
| CVE-2026-45659 Microsoft SharePoint Server deserialization remote code executionransomware usewrite-up | [ HIGH ] | 8.8 | 80.2% | |
| CVE-2026-32201 SharePoint Server spoofing via improper input validationwrite-up | [ MEDIUM ] | 6.5 | 44.0% | |
| CVE-2026-20963 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 29.2% | |
| CVE-2025-49706 Microsoft SharePoint Improper Authentication Vulnerabilityransomware use | [ MEDIUM ] | 6.5 | 99.9% |
- Certighost: Low-Priv AD Users Can Impersonate DCs
- Bing SVG Flaw Ran Code as SYSTEM on Microsoft Servers
- N-Day Is Now N-Hour: The Vanishing Patch Window
- SharePoint RCE on KEV; Attackers Pivot to Machine Keys
- Exchange 2016 and 2019 Lose ESU Patches in October
- SharePoint attackers stealing keys — rotate credentials now