CVE-2026-50522
Microsoft SharePoint Remote Code Execution Vulnerability
Description
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
In plain language
AI Act nowCVE-2026-50522 is a Microsoft SharePoint flaw that can let an attacker run malicious code over the network without needing a login; if you run SharePoint (2016/2019/Subscription Edition), you should patch right away.
CVE-2026-50522 is a remote code execution issue in Microsoft SharePoint caused by unsafe deserialization of crafted serialized data received over the network, with no authentication or user interaction required; apply the fixed SharePoint builds for 2016, 2019, and Subscription Edition.
What to do now
- Check which Microsoft SharePoint version you run (Enterprise Server 2016, Server 2019, or Subscription Edition) and confirm the currently installed build number.
- If you are on any affected build, upgrade SharePoint to the fixed version for your edition: Enterprise Server 2016 → 16.0.5561.1001.
- If you are on Microsoft SharePoint Server 2019, upgrade to 16.0.10417.20175.
- If you are on Microsoft SharePoint Server Subscription Edition, upgrade to 16.0.19725.20434.
- After upgrading, verify the new SharePoint build is installed and that the SharePoint services are healthy.
CVSS Vector Breakdown
AV:NAttack VectorAC:LAttack ComplexityPR:NPrivileges RequiredUI:NUser InteractionS:UScopeC:HConfidentialityI:HIntegrityA:HAvailabilityWeaknesses
Affected Products
Exploitability
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Attack Graph
Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.
MITRE ATT&CK
3 techniquesReferences
- SharePoint Vulnerability Exploited Shortly After PoC Releaseen-us·SecurityWeek· Exploited SharePoint auth-bypass
- 200 accounts compromised in Swiss government’s Microsoft SharePoint breachen-us·Help Net Security· Exploited SharePoint Servers data-breach
- August 2026 Patch Tuesday forecast: How do we deal with the patch apocalypse?en-us·Help Net Security·
- Swiss government SharePoint breach compromised 200 accountsen-us·BleepingComputer· Exploited Microsoft SharePoint data-breach
- 27th July – Threat Intelligence Reporten-us·Check Point Research· Roundup
- Week in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breacheden-us·Help Net Security· Roundup ServiceNow AI Platform
- Another SharePoint RCE exploited: Patch, then rotate your machine keys (CVE-2026-50522)en-us·Help Net Security· Exploited SharePoint rce
- Fourth SharePoint Vulnerability Exploited in Past Month’s Wave of Attacksen-us·SecurityWeek· Exploited SharePoint Server network-edge
- Critical SharePoint RCE flaw exploited to steal machine keysen-us·BleepingComputer· Exploited SharePoint rce
- Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoCen·The Hacker News· Exploited SharePoint Server rce
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2026-50522 and every CVE in our database. Create a free account — no credit card required.
Create Free Account