CVE-2026-50522

Microsoft SharePoint Remote Code Execution Vulnerability

Exploited in the wild. In CISA KEV since 2026‑07‑22. Fixed versions are out.

CVSS 3.19.8Critical EPSS percentile87th3.0% chance in 30 days CISA KEVListedsince 2026-07-22, due 2026-07-25
No public exploit known Fix4 products3 fixed builds listed below

Published 2026-07-14Updated 2026-07-23Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Microsoft SharePoint Enterprise Server 2016Affected: ≥ 16.0.0, < 16.0.5561.1001Upgrade to: 16.0.5561.1001Stated by: CVE record
Microsoft SharePoint Server 2019Affected: ≥ 16.0.0, < 16.0.10417.20175Upgrade to: 16.0.10417.20175Stated by: CVE record
Microsoft SharePoint Server Subscription EditionAffected: ≥ 16.0.0, < 16.0.19725.20434Upgrade to: 16.0.19725.20434Stated by: CVE record
Microsoft Sharepoint ServerAffected: < 16.0.19725.20434Upgrade to: 16.0.19725.20434Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which Microsoft SharePoint version you run (Enterprise Server 2016, Server 2019, or Subscription Edition) and confirm the currently installed build number.
If you are on any affected build, upgrade SharePoint to the fixed version for your edition: Enterprise Server 2016 → 16.0.5561.1001.
If you are on Microsoft SharePoint Server 2019, upgrade to 16.0.10417.20175.
If you are on Microsoft SharePoint Server Subscription Edition, upgrade to 16.0.19725.20434.
After upgrading, verify the new SharePoint build is installed and that the SharePoint services are healthy.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

5 publishers

Hackers exploit the critical CVE-2026-50522 SharePoint RCE flaw to steal machine keys and maintain access after patching.
as reported · Oct 2, 2026·SecurityWeek summary
Added to CISA KEV catalog
Jul 22, 2026·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened. 12 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

In plain language

Written by AI from the record

CVE-2026-50522 is a Microsoft SharePoint flaw that can let an attacker run malicious code over the network without needing a login; if you run SharePoint (2016/2019/Subscription Edition), you should patch right away.

CVE-2026-50522 is a remote code execution issue in Microsoft SharePoint caused by unsafe deserialization of crafted serialized data received over the network, with no authentication or user interaction required; apply the fixed SharePoint builds for 2016, 2019, and Subscription Edition.

If you're affected

Full server compromise
Ransomware risk
Business disruption
Data theft from SharePoint

What is it

Think of SharePoint as a building that receives messages from the internet. This flaw is like a “mailbox” that can be tricked into opening and acting on malicious instructions instead of treating the message as data. That can let an attacker take control of the server and disrupt your business.

Who is affected

This matters if you run Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition for your company. The issue is reachable over the network and does not require a login or user action. The risk is highest when the vulnerable SharePoint endpoints are reachable from the internet (or otherwise accessible to untrusted parties).

How urgent is it

This should be treated as RED urgency because it is a remote code execution flaw: attackers can send crafted network data that causes arbitrary code execution, without needing authentication. Even though there’s no confirmed public exploit code or clear dated exploitation reports in the findings, the combination of remote reachability and no-login requirement makes patching the safest move now.

What to do — in detail

Identify your SharePoint edition and build

Determine whether you run Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition.
Record the exact currently installed SharePoint build number.

Determine whether you’re vulnerable

Compare your build against the fixed versions from the patch findings:
- Enterprise Server 2016: fixed in 16.0.5561.1001
- Server 2019: fixed in 16.0.10417.20175
- Subscription Edition: fixed in 16.0.19725.20434
If your build is older than the fixed build for your edition, you should assume exposure.

Upgrade to the fixed build

Upgrade SharePoint to the fixed version matching your edition (use the exact build numbers above).
Plan for normal patching steps: take backups/snapshots as your process requires, schedule downtime if needed, and ensure the patch is applied successfully.

Verify after installation

Confirm the installed SharePoint build matches the fixed version for your edition.
Confirm SharePoint services start correctly and that key sites/pages and search (if applicable) work as expected.

If you cannot patch immediately (temporary risk reduction)

Restrict network access to SharePoint so it is not reachable from untrusted networks (for example, limit inbound access to known corporate IPs / approved reverse proxies / VPN users).
Review firewall/proxy/WAF rules to ensure only necessary traffic reaches SharePoint.

What to monitor

After patching, monitor SharePoint and web/application logs for unusual requests that resemble exploit attempts (unexpected serialized-data patterns, spikes in 4xx/5xx around the same endpoints, or repeated requests from the same external IPs).

CISA KEV note

This CVE is not listed in the CISA KEV set per the findings, so prioritize it based on severity and exposure rather than KEV status.

Technical context

CVE-2026-50522 is classified as Remote Code Execution (CWE-502 is unsafe deserialization). The mechanism described in the findings is remote code execution by sending crafted serialized data over the network. The findings state no authentication and no user interaction are required. The flaw condition includes that untrusted data deserialization is enabled in SharePoint.

Exploitation/availability context from findings:

CISA KEV: not listed.
Public exploit code: none on record in the findings.
Real-world exploitation reports: no clear dated claim and no articles stating exploitation in the findings.
Patch status: fixed builds are provided for SharePoint Enterprise Server 2016 (16.0.5561.1001), SharePoint Server 2019 (16.0.10417.20175), and SharePoint Server Subscription Edition (16.0.19725.20434).

Why it’s severe:

If reachable, an attacker can deliver malicious serialized payloads that are deserialized by SharePoint in a way that permits arbitrary code execution, leading to complete compromise potential (server control and downstream data impact).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS87th

CISA KEV

Listed as exploited in the wild since 2026-07-22.

US federal agencies must remediate by 2026-07-25.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

3.0% chance of exploitation activity in the next 30 days, which ranks it in the 87th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising.

Lifecycle

22 events over 78 days, from the signal feeds we watch.

2026-09-30EPSS band changehigh → low
2026-09-24EPSS band changehigh → lowepss band change
2026-08-03EPSS band changemoderate → high
2026-07-24EPSS band changemoderate → highepss band change
2026-07-23Patch availablepatch available, record updated, record updated
2026-07-22Added to CISA KEVpatch available, record updated

Affected products

Microsoftcommercial · US
- Microsoft SharePoint Enterprise Server 2016Web AppOn-premEnterprise Software / itsm-monitoring
- Microsoft SharePoint Server 2019Web AppOn-premEnterprise Software / itsm-monitoring
- Microsoft SharePoint Server Subscription EditionWeb AppOn-premEnterprise Software / collaboration-groupware
- sharepoint serverWeb AppOn-premEnterprise Software / collaboration-groupware

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable