SharePoint unauthenticated RCE actively exploited (CVE-2026-50522) [PoC]
CVE-2026-50522
CVE-2026-50522: SharePoint unauthenticated RCE via deserialization (CVSS 9.8) - actively exploited, added to CISA KEV. Apply June 2026 security updates or enable Windows Defender as mitigation.
Actively exploited in the wild - CVE-2026-50522 is a critical deserialization vulnerability in Microsoft Office SharePoint Server that grants unauthenticated remote code execution over the network. CISA has confirmed active exploitation and added this to its Known Exploited Vulnerabilities catalog - patch immediately.
Overview
CVE-2026-50522 is a deserialization of untrusted data vulnerability in Microsoft Office SharePoint Server. An unauthenticated attacker can send specially crafted network requests to an affected SharePoint server to trigger code execution without any user interaction or prior authentication. The vulnerability carries a CVSS 9.8 (Critical) rating due to its network-based attack vector, low complexity, and no required privileges.
The issue stems from how SharePoint deserializes user-supplied data without proper validation. Successful exploitation allows the attacker to execute arbitrary code in the security context of the SharePoint application pool, typically running with high system privileges. This means an attacker can install programs, view, change, or delete data, and create new accounts with full user rights.
Affected Systems
All supported versions of Microsoft SharePoint Server are affected. Microsoft has released out-of-band security updates for SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition (version 23H2 and later). Customers running SharePoint in Microsoft 365 are not affected.
Remediation
Microsoft has released security updates as part of the June 2026 Patch Tuesday cycle. Apply the updates immediately via Windows Update, WSUS, or the Microsoft Update Catalog. No workarounds are available for this vulnerability, though administrators can reduce attack surface by blocking untrusted network traffic to SharePoint endpoints and ensuring Windows Defender Antivirus is enabled with real-time protection.
Priority should be given to internet-facing SharePoint servers and any instances accessible from untrusted networks.
Additional Context
This vulnerability is related to SharePoint RCE CVE-2026-45659, another SharePoint deserialization flaw previously added to CISA KEV. The recurrence of deserialization issues in SharePoint suggests a systemic weakness in Microsoft’s input validation approach for this product line. For broader context, see the Weekly Threat Roundup: Orkes Conductor RCE (June 29–July 5) and Weekly Threat Roundup: APT28 DNS Hijacking (Apr 6-12.
Security Insight
This marks the second SharePoint deserialization RCE added to CISA’s KEV catalog within three months, suggesting attackers have developed reliable exploit techniques for this class of vulnerability. Microsoft has not disclosed whether these issues share a common root cause, but the pattern indicates that SharePoint’s deserialization handling remains a weak point. Organizations should treat SharePoint as a high-value target and consider network segmentation and application-level firewalling as long-term mitigations beyond patching.
Further Reading
Never miss a critical vulnerability
Get real-time security alerts delivered to your preferred platform.
Public PoC References
Unverified third-party code
These repositories are publicly listed on GitHub and have not been audited by Yazoul Security. They may contain malware, backdoors, destructive payloads, or operational security risks (telemetry, exfiltration). Treat them as hostile binaries. Inspect source before execution. Run only in isolated, disposable lab environments (offline VM, no credentials, no production data).
Authorized use only. This information is provided for defensive research, detection engineering, and patch validation. Using exploit code against systems you do not own or do not have explicit written permission to test is illegal in most jurisdictions and violates Yazoul's terms of use.
| Repository | Stars |
|---|---|
| HORKimhab/CVE-2026-50522 CVE-2026-50522 - Draft | ★ 0 |
Showing 1 of 1 known references. Source: nomi-sec/PoC-in-GitHub.
Related Advisories
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network....
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network....
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network....
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network....
Other Microsoft Sharepoint Server Vulnerabilities
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network....
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network....
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network....
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network....