Critical SharePoint RCE CVE-2026-50522 Enables Machine-Key Theft and Persistent Access

Overview/Introduction

On July 21, 2026, security researchers confirmed that Microsoft SharePoint Server is under active exploitation for a newly disclosed critical remote code execution (RCE) vulnerability, CVE-2026-50522. The flaw-rated 9.8 on the CVSS scale-allows an unauthenticated adversary to inject a malicious .NET BinaryFormatter payload via SharePoint’s WS-Federation sign-in flow. Within hours of a public PowerShell proof-of-concept (PoC) being released on GitHub, threat actors began targeting vulnerable on-premises SharePoint installations to steal the server’s machine-key. Possession of this key enables the creation of forged authentication tokens, granting persistent, high-privilege impersonation across the SharePoint farm.

Technical Details

CVE Identifier: CVE-2026-50522
CVSS v3.1 Base Score: 9.8 (Critical)
Vulnerability Type: Deserialization of untrusted data (remote code execution)
Affected Products: All supported on-premises Microsoft SharePoint Server versions (Subscription Edition, 2019, 2016, 2013) as of July 2026.

Attack Vector

The vulnerability resides in the handling of the SecurityContextToken that is part of the WS-Federation sign-in response posted to the endpoint /_trust/default.aspx. SharePoint deserializes the token using the .NET BinaryFormatter without sufficient validation. An attacker can craft a malicious token where the serialized object contains a ObjectDataProvider or similar gadget chain that executes arbitrary code upon deserialization.

Exploitation Method

The publicly released PoC (authored by security researcher Janggggg) demonstrates the following steps:

1. Generate a malicious .NET BinaryFormatter payload (e.g., PowerShell command execution).
2. Encode the payload and embed it into a forged SecurityContextToken cookie.
3. Send an HTTP POST request to https://target-sharepoint/_trust/default.aspx with the crafted token.
4. SharePoint deserializes the token, triggering the payload and executing code under the SharePoint service account.
5. The payload reads the encrypted machineKey value from the web.config or registry and exfiltrates it to an attacker-controlled server.

Because the exploit does not require any prior authentication, the attack complexity is low (AC:L) and the vector is network-based (AV:N). Once the machine-key is obtained, the adversary can generate valid ASP.NET_SessionId and FedAuth cookies, effectively impersonating any user-including farm administrators-without further exploitation of the original RCE.

Impact Analysis

The direct impact of CVE-2026-50522 is two-fold:

• Remote Code Execution: An unauthenticated attacker can achieve arbitrary code execution on the SharePoint web front-end, potentially compromising the entire farm.
• Machine-Key Theft: Extraction of the farm’s machine-key enables creation of forged authentication tokens, resulting in persistent, stealthy impersonation even after the original vulnerability is patched.

Organizations that run SharePoint Server on internal networks, DMZs, or expose it to the internet are at high risk. The ability to steal the machine-key dramatically expands the attack surface, as the same key is used across all web applications in the farm, allowing lateral movement to other services that rely on the same ASP.NET machine-key (e.g., custom web apps, Office Web Apps).

Timeline of Events

• July 14, 2026: Microsoft releases July Patch Tuesday updates, including a fix for CVE-2026-50522.
• July 17, 2026: Defused Cyber reports anomalous SharePoint deserialization attempts in its honeypot network, predating any public exploit.
• July 20, 2026: WatchTowr publishes a blog post confirming active exploitation of CVE-2026-50522, noting that attackers are stealing machine-keys via a single request.
• July 20, 2026: GitHub user Janggggg uploads a PowerShell PoC that triggers the vulnerability.
• July 21, 2026: Multiple security outlets (The Hacker News, BleepingComputer, SecurityWeek) report the active exploitation and the emergence of real-world attacks.
• July 22-27, 2026: Enterprises begin to observe abnormal authentication token usage; incident response teams start forensic analysis to locate potential machine-key exfiltration.

Mitigation/Recommendations

While applying the July 2026 security update is the first and mandatory step, the following additional controls are essential to eradicate the threat and limit future exposure:

1. Patch Immediately: Deploy the SharePoint Server July 2026 cumulative update to all on-premises farms. Verify the patch level using Get-SPFarm | Select BuildVersion.
2. Rotate Machine-Key: After patching, generate a new machineKey in the web.config of every SharePoint web application. Use the aspnet_regiis -pc tool or manually edit the machineKey element with a new validation and decryption key.
3. Invalidate Existing Tokens: Force a sign-out of all users by recycling the SharePoint IIS application pools or restarting the SharePoint timer service. This revokes any forged FedAuth cookies derived from a stolen key.
4. Network Segmentation: Restrict inbound traffic to SharePoint front-ends to trusted subnets only. Use web application firewalls (WAF) to block malformed SecurityContextToken payloads.
5. Application Hardening: Disable the vulnerable WS-Federation endpoint if not used (e.g., set EnableClaimsAuthentication to false in the SharePoint Central Administration).
6. Logging & Detection: Enable detailed SharePoint ULS logging for SecurityContextToken processing failures. Deploy SIEM correlation rules to alert on unusually large POST bodies to /_trust/default.aspx or outbound connections to unknown exfiltration hosts.
7. Credential Hygiene: Rotate any service accounts that were used by SharePoint (e.g., farm admin, web-app pool identities) and review their permissions for least-privilege compliance.
8. Penetration Testing: Conduct a focused test against the WS-Federation sign-in flow to confirm the vulnerability is fully remediated.

Real-World Impact

Enterprises that rely heavily on SharePoint for document collaboration, workflow automation, and intranet portals face several tangible risks:

• Data Exfiltration: Attackers with a valid machine-key can download confidential documents, source code, or financial records without triggering typical access-control alerts.
• Privilege Escalation: By forging admin-level tokens, adversaries can add new farm administrators, install malicious web parts, or modify web.config to embed further backdoors.
• Supply-Chain Threats: Compromised SharePoint farms often host custom solutions that integrate with ERP, CRM, or HR systems. A stolen machine-key can be used to pivot into these downstream applications.
• Regulatory Fallout: For regulated industries (e.g., healthcare, finance), the loss of protected data and the inability to demonstrate timely patching may result in fines under HIPAA, GDPR, or PCI DSS.

Because the exploitation chain does not require authentication, even organizations that enforce strict internal network segmentation are vulnerable if the SharePoint front-end is reachable from the internet or from compromised internal hosts.

Expert Opinion

From a strategic standpoint, CVE-2026-50522 underscores a growing trend: attackers are moving beyond “one-off” RCE exploits toward techniques that harvest persistent authentication artifacts. The machine-key theft component is particularly alarming because it effectively nullifies the value of patching if the key is not rotated. In the past, similar “key-stealing” tactics have been seen in IIS and ASP.NET Core environments, but SharePoint’s deep integration with Office 365 and its role as a data hub magnify the impact.

Organizations must treat SharePoint not just as a content management system but as a critical authentication authority. This means that traditional patch-first approaches must be complemented with credential rotation, token revocation, and continuous monitoring of token-related traffic. Moreover, the rapid emergence of a public PoC-and the speed at which threat actors adopted it-demonstrates the importance of threat-intel-driven patch prioritization. Enterprises that rely on a “patch-when-you-can” cadence are likely to fall behind in this accelerated attack landscape.

Looking ahead, I anticipate that Microsoft will tighten the deserialization path in future releases, possibly deprecating the use of BinaryFormatter in authentication flows altogether. In the meantime, security teams should treat any exposure of the SharePoint machine-key as a critical credential compromise and respond with the same urgency as a leaked admin password.