Microsoft SharePoint Remote Code Execution Vulnerability (CVE-2026-50522)

What is affected, what to do

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

The vulnerability is being actively exploited; treat it as a priority. Update Microsoft SharePoint Enterprise Server 2016 to version 16.0.5561.1001, Microsoft SharePoint Server 2019 to version 16.0.10417.20175, Microsoft SharePoint Server Subscription Edition to version 16.0.19725.20434. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft SharePoint Enterprise Server 2016 lt 16.0.0..16.0.5561.1001
• Microsoft SharePoint Server 2019 lt 16.0.0..16.0.10417.20175
• Microsoft SharePoint Server Subscription Edition lt 16.0.0..16.0.19725.20434

Fixed in

• Microsoft SharePoint Enterprise Server 2016 16.0.5561.1001
• Microsoft SharePoint Server 2019 16.0.10417.20175
• Microsoft SharePoint Server Subscription Edition 16.0.19725.20434

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Enumerate every on-premises SharePoint Server farm on the 16.0 build line and record its build (Get-SPFarm | Select BuildVersion). The context explicitly lists build 16.0.19725.20434 as affected. Prioritise internet-reachable farms on TCP 80/443, including those published through a reverse proxy.
   • Patch: The context indicates an official fix is available (RL:O). Patch available from the vendor — look up the exact version in the vendor advisory. Install the update on every server in the farm, then run PSConfig.exe -cmd upgrade -inplace b2b -wait or the Configuration Wizard.
   • Reduce exposure: If a farm cannot be patched today, block external access at the perimeter. Alternatively, restrict access to VPN or a pre-authenticating Zero Trust proxy.
   • Rotate keys: After patching, rotate the ASP.NET machine keys (Set-SPMachineKey -WebApplication <URL>, then Update-SPMachineKey -WebApplication <URL>), and run iisreset on all farm servers. SharePoint deserialization intrusions routinely steal the ValidationKey and DecryptionKey. Without rotation, attackers can keep abusing signed ViewState even on a patched farm.
   • Compromise assessment: Before returning exposed servers to normal service, hunt for webshells and anomalous w3wp.exe child processes (see Detection rules). On any hit, isolate the host, preserve forensic images, and start NIS2/BSIG incident reporting (24 h early warning).
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Place SharePoint front-ends in a dedicated DMZ or application zone. Default-deny internet egress from SharePoint and SQL servers to cut off payload staging and C2 traffic.
   • Endpoint hardening: Enable SharePoint AMSI integration, preferably in Full Mode, backed by Microsoft Defender Antivirus or an AMSI-capable EDR. Enable ASR rules, in particular "Block process creations originating from PSExec and WMI commands". Configure EDR policy to block, or at minimum alert on, child processes spawned by w3wp.exe.
   • WAF/IPS: Block unauthenticated POSTs to /_layouts/15/*.aspx that carry oversized __VIEWSTATE values or Base64 blobs with .NET gadget signatures. Examples are AAEAAAD///// (the BinaryFormatter header) or TypeConfuseDelegate and ObjectDataProvider in the decoded body. Watch for spoofed Referer headers pointing to /_layouts/SignOut.aspx. Enable vendor IPS signatures for this CVE as soon as they ship.
   • IAM/least privilege: The IIS application pool identity and the farm account must not hold local admin rights or Domain Admin membership. Trim SQL permissions to the minimum required and enable Credential Guard on farm servers.
   • Integrity monitoring: Apply FIM to C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\ and to the IIS site web.config files.
3. 03

   Runbook step 3

   Detection rules

   • EDR/Sysmon EID 1 or Security 4688: w3wp.exe spawning cmd.exe, powershell.exe, pwsh.exe, csc.exe, certutil.exe or rundll32.exe. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "w3wp.exe" and FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","csc.exe","certutil.exe").
   • Sysmon EID 11 (FileCreate): New .aspx or .ashx files under ...\16\TEMPLATE\LAYOUTS\ or in IIS webroots, written by w3wp.exe or powershell.exe. Sigma shape: Image|endswith: '\w3wp.exe' and TargetFilename|contains: '\TEMPLATE\LAYOUTS\' and TargetFilename|endswith: '.aspx'.
   • IIS access logs: POSTs to /_layouts/15/ from external IPs with no authenticated user (cs-username = -), followed by GETs to previously unseen .aspx files. SPL: index=iis cs_method=POST cs_uri_stem="/_layouts/15/*" cs_username="-" | stats count by c_ip, cs_uri_stem.
   • PowerShell logging (EID 4104) and AMSI/Defender (EID 1116/1117): Script blocks that touch System.Web.Configuration.MachineKeySection or dump the ValidationKey or DecryptionKey, plus AMSI detections attributed to w3wp.exe.
   • Network (Zeek/Suricata): Outbound connections from SharePoint servers to external destinations other than Microsoft update endpoints, especially immediately after suspicious POST bursts.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Source: certeu_advisory, CSA/SingCERT, NCSC NZ (CC BY 4.0), pwn.watch, cvelistv5, Microsoft Security Update Guide, CISA KEV Catalog, NVD (NIST), CVE.org (MITRE), BSI WID Portal, BSI CSAF

Vendors and products

• Microsoft Microsoft Sharepoint Enterprise Server 2016
• Microsoft Microsoft Sharepoint Server 2019
• Microsoft Microsoft Sharepoint Server Subscription Edition
• Microsoft Microsoft SharePoint Server Subscription Edition

Weakness classes (CWE)

• CWE-502Deserialization of Untrusted Data

  Base

  The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

  Entry at MITRE CWE-502

References & sources

• Microsoft Security Update GuideMicrosoft SharePoint Remote Code Execution VulnerabilityVendor advisory, Patch, pwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50522government-resource
• cert.cyber.gouv.frANSSI / CERT-FR: CERTFR-2026-ALE-008 – Multiples vulnérabilités dans Microsoft Sharepoint (clôturée 2026-09-22)cert-fr
• pwn.watchpwn.watch: Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability pwn-watch
• NVD (NIST)NVD: CVE-2026-50522pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch
• JPCERT/CCJPCERT/CC JPCERT-AT-2026-0020: Microsoft Releases July 2026 Security Updatesjpcert

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 23.07.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2026-50522","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-22T20:45:10.104482Z"}	{"id":"CVE-2026-50522","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-13T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

2. 22.07.2026CISA KEV entry updated9119a7d8…

   4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name

   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Date Added	added	—	2026-07-22
   Due Date	added	—	2026-07-22
   Required Action	added	—	2026-07-22
   Vulnerability Name	added	—	2026-07-22

   Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

3. 22.07.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2026-50522","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-13T00:00:00+00:00"}	{"id":"CVE-2026-50522","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-22T20:45:10.104482Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

4. 22.07.2026Record modifiedCISA ADP

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50522
   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50522

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Linked advisories

• CISA Adds Critical Check Point Flaw to Known Exploited Vulnerabilities CatalogSANS NewsBites27.07.2026
• @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 28SANS @RISK23.07.2026
• Multiples vulnérabilités dans Microsoft Sharepoint (22 juillet 2026)CERT-FR (ANSSI)22.07.2026