CVE-2026-50522: Critical SharePoint RCE via Deserialization of Untrusted Data

Overview

CVE-2026-50522 is a critical deserialization of untrusted data vulnerability affecting Microsoft SharePoint Server. This flaw allows an unauthorized attacker to execute arbitrary code remotely over a network without user interaction. The vulnerability is actively exploited in the wild, posing a significant risk of full SharePoint compromise and potential lateral movement, including machine key theft.

Technical Analysis

The vulnerability, classified as CWE-502 (Deserialization of Untrusted Data), exists within Microsoft SharePoint Server. An attacker can exploit this flaw by sending specially crafted network requests that, when deserialized by the SharePoint application, lead to arbitrary code execution.

• Vulnerability Type: Deserialization of Untrusted Data (CWE-502).
• Affected Products:
  • microsoft sharepoint_server versions prior to 16.0.19725.20434
  • microsoft sharepoint_server 2016
  • microsoft sharepoint_server 2019
• CVSS v3.1 Score: 9.8 (CRITICAL) – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N). No authentication or user interaction is required (PR:N, UI:N).
• Impact: Complete compromise of confidentiality, integrity, and availability (C:H, I:H, A:H) due to remote code execution.
• Exploitation: Publicly reported exploitation includes the theft of SharePoint machine keys, which can lead to further compromise of the SharePoint farm. The ViewState malware family is linked to exploitation.

Detection

Detection efforts should focus on identifying post-exploitation activity and suspicious network requests targeting SharePoint servers.

• Process Creation Monitoring: Monitor for unusual child processes spawned by SharePoint-related processes (e.g., w3wp.exe, owstimer.exe). Look for cmd.exe, powershell.exe, pwsh.exe, mshta.exe, cscript.exe, wscript.exe, or other scripting/system utilities.
• Web Server Logs: Analyze IIS/web server logs for SharePoint for unusual POST requests, particularly those with large payloads, suspicious user agents, or requests to uncommon application pages.
• File System Monitoring: Monitor for new or modified files in SharePoint web directories (_layouts, _vti_bin, wpresources) that could indicate webshell deployment or other persistence mechanisms.
• Network Traffic Analysis: Look for unusual outbound connections from SharePoint servers to external IPs, especially after suspicious inbound requests.
• Registry/File Access: Monitor for access to SharePoint configuration files (web.config) or registry keys related to machine keys, as this has been observed in active exploitation.

Sigma Detection Rules

SharePoint IIS Worker Suspicious Child Process

title: SharePoint IIS Worker Suspicious Child Process
id: d7e0f8b1-c9a3-4e6d-b2f5-a1c8e7d4f0a9
status: experimental
description: Detects suspicious process creation (e.g., cmd, powershell) by an IIS worker process (w3wp.exe), which is a common indicator of RCE on SharePoint servers.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: '\\w3wp.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\mshta.exe'
      - '\\cscript.exe'
      - '\\wscript.exe'
  condition: selection
level: critical

SharePoint Timer Service Suspicious Child Process

title: SharePoint Timer Service Suspicious Child Process
id: e9c2d1a0-f3b4-4c5d-a6e7-b8f9c0d1e2f3
status: experimental
description: Detects suspicious process creation (e.g., cmd, powershell) by the SharePoint Timer Service (owstimer.exe), which can also be exploited for RCE.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: '\\owstimer.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\mshta.exe'
      - '\\cscript.exe'
      - '\\wscript.exe'
  condition: selection
level: critical

Mitigations

1. Patch Immediately: Apply the latest security updates from Microsoft for SharePoint Server. Specifically, update to 16.0.19725.20434 or later for affected versions. Refer to the Microsoft Security Response Center (MSRC) advisory for CVE-2026-50522.
2. Network Segmentation: Isolate SharePoint servers from untrusted networks and segment them from other critical internal systems.
3. Least Privilege: Ensure SharePoint service accounts and application pools run with the minimum necessary privileges.
4. Web Application Firewall (WAF): Deploy a WAF in front of SharePoint servers to detect and block malicious web requests, though specific deserialization payloads may be difficult to block without specific signatures.
5. Regular Backups: Maintain regular, tested backups of SharePoint farms to facilitate recovery in case of compromise.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50522
• https://nvd.nist.gov/vuln/detail/CVE-2026-50522
• https://thehackernews.com/2026/07/critical-sharepoint-rce-cve-2026-50522.html
• https://www.resecurity.com/blog/article/from-web-request-to-domain-compromise-understanding-the-july-2026-sharepoint-attacks
• https://www.bleepingcomputer.com/news/security/critical-sharepoint-rce-flaw-exploited-to-steal-machine-keys/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

• T1190 — Exploit Public-Facing Application
• T1059 — Command and Scripting Interpreter
• T1552.004 — Private Keys
• T1505.003 — Web Shell
• T1036 — Masquerading
• T1530 — Data from Cloud Storage
• T1213 — Data from Information Repositories
• T1059.001 — PowerShell