Deserialization of untrusted data in Microsoft Office SharePoint

CVE-2026-50522 is a CWE-502 unsafe deserialization flaw in on-premises Microsoft SharePoint Server. An unauthenticated attacker POSTs a crafted __VIEWSTATE (or similar serialized) payload to an exposed SharePoint endpoint; the server rehydrates the object graph and executes an attacker-controlled gadget chain in the w3wp.exe worker process — typically running as the SharePoint farm service account. Affected products: SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise. SharePoint Online (Microsoft 365) is not affected.

Microsoft's CRITICAL / 9.8 rating is accurate and, if anything, understated by the CVSS math given the operational reality. This is the same class of bug family as the 2025 ToolShell chain (CVE-2025-53770 / -49704 / -49706): unauthenticated, network-reachable, and the compromise persists via stolen ASP.NET machine keys which let attackers forge valid __VIEWSTATE blobs even after the vendor patch is applied. A public PoC dropped from watchTowr on July 20; honeypots caught mass-scan exploitation within hours. Nothing about the friction audit softens this one.

Why this verdict

• Unauthenticated, network-reachable RCE — no credentials, no user interaction, one HTTP POST. AV:N/AC:L/PR:N/UI:N holds up under scrutiny.
• Public PoC + active exploitation — watchTowr's PoC is being weaponized in the wild as of July 20; EPSS will catch up but the operational signal is already here.
• Role multiplier: SharePoint as identity-adjacent tier — the chain lands as a farm service account that typically holds SQL rights and Kerberos delegation paths; blast radius routinely reaches AD. This is the high-value-role scenario and it represents the *typical* deployment, not the edge case. Floor = CRITICAL.
• Post-patch persistence via machineKey theft — patching alone does not evict the attacker. Historical ToolShell 2025 data shows re-compromise within weeks when keys weren't rotated.
• ~8-9k internet-exposed instances across Shodan/Censys; internal-only farms are still reachable to any attacker with a phishing foothold.

Why not higher?

There is no higher tier than CRITICAL / 9.8 in CVSS v3.1. If a 10.0 were reachable, this would qualify only if Scope:Changed applied — it does not, because compromise stays within the SharePoint security authority initially. The score is already at the ceiling.

Why not lower?

Downgrading would require narrow affected versions (it's not — three major SKUs), auth requirement (there isn't one), or low exposure (there are thousands of exposed instances plus universal internal reachability). None of the standard friction levers apply, and the deployment-role floor is CRITICAL by definition.

1. Apply July 2026 SharePoint CU immediately — Per the noisgate mitigation SLA for CRITICAL + active exploitation, patch within hours, not days. Deploy the July 14, 2026 CU per SKU (SE / 2019 / 2016).
2. Rotate ASP.NET machineKey on every farm, then IISRESET — The patch does not invalidate keys already stolen. Use Update-SPMachineKey (SE/2019) or manual <machineKey> regeneration in web.config for 2016. Do this within the same 3-day CRITICAL mitigation window even if you already patched.
3. Block SharePoint from the public internet at the edge — Front with Entra Application Proxy, Cloudflare Access, or a reverse proxy enforcing pre-auth. Do this within 24 hours if patching lags.
4. Enable AMSI integration for SharePoint — SharePoint SE/2019 supports AMSI; when enabled, Defender/EDR inspects deserialization payloads inline and blocks known ysoserial.net gadgets. Set-SPAntivirusScanForRepresentedInvocation-equivalent config.
5. Hunt for indicators of prior compromise — Search for spinstall0.aspx, debug_dev.aspx, unexpected files under /_layouts/15/, w3wp.exe spawning cmd/powershell, and outbound egress from the SharePoint host to non-corporate destinations. If pre-patch exposure existed, assume compromise until proven otherwise.
6. Constrain the SharePoint farm service account — Remove Domain Admin equivalence; enforce protected-users group, resource-based constrained delegation only. Limits the blast radius even if the next SharePoint 0-day lands.

Run this on the SharePoint server itself in an elevated PowerShell console (as farm admin or local admin). Invocation: .\Check-CVE-2026-50522.ps1. Reports VULNERABLE / PATCHED / UNKNOWN based on SharePoint product build vs the July 2026 CU baselines.

#Requires -Version 5.1
#Requires -RunAsAdministrator
# Check-CVE-2026-50522.ps1
# Detects SharePoint 2016/2019/SE patch level vs July 2026 CU

$ErrorActionPreference = 'Stop'

# July 2026 CU minimum patched builds (verify against current MS advisory)
$patchedBuilds = @{
    '16.0.5xxx' = [Version]'16.0.17928.20000' # SharePoint SE
    '16.0.10'   = [Version]'16.0.10417.20050' # SharePoint 2019
    '16.0.4'    = [Version]'16.0.5495.1000'   # SharePoint 2016
}

try {
    Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction Stop
} catch {
    Write-Output 'UNKNOWN: SharePoint snap-in unavailable — is this a SharePoint server?'
    exit 2
}

$farm = Get-SPFarm
$build = $farm.BuildVersion
Write-Output "Detected SharePoint build: $build"

$sku = switch -Regex ($build.ToString()) {
    '^16\.0\.179' { 'SE' ; break }
    '^16\.0\.104' { '2019' ; break }
    '^16\.0\.5[0-4]' { '2016' ; break }
    default { 'UNKNOWN' }
}

if ($sku -eq 'UNKNOWN') {
    Write-Output 'UNKNOWN: could not map build to SKU'
    exit 2
}

$minPatched = switch ($sku) {
    'SE'   { $patchedBuilds['16.0.5xxx'] }
    '2019' { $patchedBuilds['16.0.10'] }
    '2016' { $patchedBuilds['16.0.4'] }
}

if ([Version]$build -ge $minPatched) {
    Write-Output "PATCHED: SharePoint $sku build $build meets July 2026 CU baseline $minPatched"
    Write-Output 'REMINDER: rotate machineKey and hunt for prior compromise regardless of patch state.'
    exit 0
} else {
    Write-Output "VULNERABLE: SharePoint $sku build $build is below required $minPatched — apply July 2026 CU immediately"
    exit 1
}

Sources

1. Microsoft MSRC advisory (via Tenable)
2. The Hacker News — active exploitation after PoC
3. SecurityAffairs — public PoC triggers exploitation
4. SentinelOne vulnerability entry
5. IONIX threat center writeup
6. BleepingComputer — machine-key theft campaign
7. Cybersecurity Dive — SharePoint under attack
8. Akamai research — RCE detections & mitigations