The in-the-wild exploitation of yet another SharePoint vulnerability has come to light – the fourth in the past month.
The flaw is tracked as CVE-2026-50522, and it was fixed by Microsoft on July 14 with its latest Patch Tuesday updates.
Microsoft describes CVE-2026-50522 as a critical remote code execution vulnerability stemming from deserialization of untrusted data.
“In a network-based attack, an attacker authenticated as at least a Site Owner, could write arbitrary code to inject and execute code remotely on the SharePoint Server,” the company wrote in its advisory.
Threat intelligence firm Defused appears to be the first to have observed exploitation of CVE-2026-50522.
The company reported on July 17 that its honeypots had seen exploitation attempts targeting what appeared to be a zero-day SharePoint vulnerability. However, in an update shared on July 20, Defused said the targeted vulnerability was likely CVE-2026-50522.
One day later, shortly after PoC exploit code was released, security firm WatchTowr confirmed active exploitation.
According to the company, threat actors are “stealing machine keys to retain long-term access”.
“Attackers are pulling SharePoint machine keys via a single request,” WatchTowr noted, adding, “Patching is not enough; defenders should rotate credentials on any assets that may have been exposed.”
Microsoft has yet to update its advisory for CVE-2026-50522 to confirm in-the-wild exploitation, but it’s not uncommon for the tech giant to delay updating its advisories after attacks are detected.
The other SharePoint vulnerabilities whose exploitation has come to light in recent weeks are CVE-2026-58644, CVE-2026-56164, and CVE-2026-45659.
CISA recently warned organizations about attacks targeting SharePoint instances. The agency’s Known Exploited Vulnerabilities (KEV) catalog currently includes 13 SharePoint flaws, including five added this year. CVE-2026-50522 has not yet been added to the KEV list.
Related: Exploitation of ServiceNow Vulnerability Seen Days After Disclosure
Related: SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch
Related: WP2Shell WordPress Vulnerabilities Exploited in the Wild
