Published July 21, 2026.

SharePoint CVE-2026-50522, a critical CVSS 9.8 remote code execution flaw in on-premises SharePoint Server, is under active exploitation after a public proof-of-concept was released, according to watchTowr. It is the third SharePoint flaw from Microsoft's July 2026 Patch Tuesday to be attacked — patch on-prem SharePoint Server immediately.

What happened. Threat actors are exploiting CVE-2026-50522, a deserialization of untrusted data vulnerability (CWE-502) in Microsoft Office SharePoint that lets an unauthenticated attacker execute code over the network. watchTowr reported in-the-wild exploitation after a public PoC lowered the bar to entry. It is the third SharePoint Server vulnerability from the July 2026 Patch Tuesday cycle to come under active attack, continuing a pattern of on-premises SharePoint being rapidly weaponized once technical details circulate.

How severe is SharePoint CVE-2026-50522?

CVE-2026-50522 carries a CVSS 3.1 base score of 9.8 (Critical) with the vector AV:N/AC:L/PR:N/UI:N — network-reachable, low complexity, no privileges and no user interaction required. Its EPSS score is 20.3%, in the 97.2nd percentile of all vulnerabilities for exploitation likelihood. Because the flaw is a deserialization bug, a single crafted request can lead directly to code execution on the server.

Which SharePoint versions are affected?

Microsoft addressed the flaw in its July 2026 Patch Tuesday release; on-premises administrators must apply the update themselves.

What to do now.

• Apply the July 2026 SharePoint Server security update for CVE-2026-50522 on every on-prem farm.

• Rotate SharePoint machine keys (ASP.NET ValidationKey/DecryptionKey) after patching — deserialization exploits frequently abuse stolen keys, and patching alone does not evict an attacker who already has them.

• Hunt for web shells in SharePoint LAYOUTS directories and for unexpected w3wp.exe child processes.

• Restrict internet exposure of SharePoint admin and web endpoints where business needs allow.

Who's affected. Organizations running on-premises SharePoint Server; SharePoint Online tenants are managed by Microsoft and are not affected by this on-prem flaw.

Our read. SharePoint has become a reliable re-run: a public PoC lands, and on-prem servers are exploited within days. CVE-2026-50522 sits in the 97th EPSS percentile, and it is the third flaw from a single Patch Tuesday to be attacked — the exposure window is measured in days, not quarters. Per our 2025 KEV analysis, the median gap from disclosure to exploitation was 26 days, and 20% of flaws were exploited on or before disclosure day. For an internet-reachable RCE with a public exploit, "we'll patch at month-end" is the vulnerability. Continuously verifying that every farm is patched — and that keys were rotated after — is the control that closes it.

Reporting by The Hacker News; exploitation detail per watchTowr. CVSS, EPSS and CWE per NVD and FIRST.org. Sources linked above. Related: our continuous verification approach.