Microsoft SharePoint Server pre-auth BinaryFormatter deserialization RCE via WS-Federation endpoint

#Requires -RunAsAdministrator
<#
  Check-CVE-2026-50522.ps1
  Checks whether the local SharePoint installation is patched for CVE-2026-50522.
  Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

try {
    $spSnap = Get-PSSnapin -Name Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue
    if (-not $spSnap) {
        Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction Stop
    }
} catch {
    # Fallback: check registry for SharePoint version
    $regPaths = @(
        'HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\16.0',
        'HKLM:\SOFTWARE\Microsoft\Office Server\16.0'
    )
    $found = $false
    foreach ($rp in $regPaths) {
        if (Test-Path $rp) {
            $found = $true
            break
        }
    }
    if (-not $found) {
        Write-Host 'UNKNOWN - SharePoint does not appear to be installed on this host.'
        exit 2
    }
}

try {
    $farm = [Microsoft.SharePoint.Administration.SPFarm]::Local
    if (-not $farm) {
        Write-Host 'UNKNOWN - Unable to connect to local SharePoint farm.'
        exit 2
    }
    $buildVersion = $farm.BuildVersion
    $major = $buildVersion.Major
    $minor = $buildVersion.Minor
    $build = $buildVersion.Build
    $rev   = $buildVersion.Revision
    $fullVersion = "$major.$minor.$build.$rev"
    Write-Host "Detected SharePoint build: $fullVersion"
} catch {
    # Fallback: read version from SharePoint DLL
    $dllPath = "${env:CommonProgramFiles}\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.dll"
    if (Test-Path $dllPath) {
        $ver = (Get-Item $dllPath).VersionInfo.FileVersion
        Write-Host "Detected SharePoint DLL version: $ver"
        $parts = $ver.Split('.')
        $major = [int]$parts[0]
        $minor = [int]$parts[1]
        $build = [int]$parts[2]
        $rev   = [int]$parts[3]
        $fullVersion = $ver
    } else {
        Write-Host 'UNKNOWN - Cannot determine SharePoint version.'
        exit 2
    }
}

# Patched builds (July 2026 Patch Tuesday):
# SP 2016: 16.0.5561.1001
# SP 2019: 16.0.10417.20175
# SP SE:   16.0.19725.20434

$vulnerable = $false
$product = 'Unknown'

if ($build -ge 19000) {
    $product = 'SharePoint Server Subscription Edition'
    if ($build -lt 19725 -or ($build -eq 19725 -and $rev -lt 20434)) {
        $vulnerable = $true
    }
} elseif ($build -ge 10000) {
    $product = 'SharePoint Server 2019'
    if ($build -lt 10417 -or ($build -eq 10417 -and $rev -lt 20175)) {
        $vulnerable = $true
    }
} elseif ($build -ge 5000) {
    $product = 'SharePoint Server 2016'
    if ($build -lt 5561 -or ($build -eq 5561 -and $rev -lt 1001)) {
        $vulnerable = $true
    }
} else {
    Write-Host "UNKNOWN - Unrecognized SharePoint build: $fullVersion"
    exit 2
}

Write-Host "Product: $product"
Write-Host "Build:   $fullVersion"

if ($vulnerable) {
    Write-Host 'VULNERABLE - This SharePoint server is NOT patched for CVE-2026-50522.'
    Write-Host 'ACTION: Apply the July 2026 Patch Tuesday update immediately and rotate machine keys.'
    exit 1
} else {
    Write-Host 'PATCHED - This SharePoint server has the fix for CVE-2026-50522.'
    Write-Host 'REMINDER: Ensure IIS machine keys have been rotated if the server was exposed pre-patch.'
    exit 0
}