SharePoint’s Fifth Exploited Flaw of 2026 Echoes Last July’s Hack

Hackers are breaking into Microsoft SharePoint servers with a single web request, stealing cryptographic keys that let them return long after a patch closes the hole they used to get in. The flaw, CVE-2026-50522, carries a maximum 9.8 out of 10 severity score and is the fifth on-premises SharePoint vulnerability to face confirmed active exploitation in 2026 alone.

This has happened before. A year ago this month, Chinese state-linked hackers used the same machine-key trick to breach dozens of organizations, including a US nuclear weapons agency, through a chain of bugs the security world nicknamed ToolShell. Defenders are now running the same drill again, against a faster clock.

Attackers Pull SharePoint’s Master Keys With One Request

Microsoft shipped a fix for CVE-2026-50522 on July 14, 2026, as part of that month’s Patch Tuesday. The bug is a deserialization-of-untrusted-data flaw in Microsoft Office SharePoint, and Microsoft credited splitline, the DEVCORE researcher whose team dominated this year’s Pwn2Own Berlin contest, with reporting it.

Microsoft’s advisory described the attack path as requiring an attacker “authenticated as at least a Site Owner” to inject and run code on the server, and rated the attack complexity low because “an attacker does not require significant prior knowledge of the system.” The company also tagged the bug “Exploitation More Likely.”

Attackers are pulling SharePoint machine keys via a single request. Patching is not enough; defenders should rotate credentials on any assets that may have been exposed.

watchTowr, an offensive security firm, said that in a LinkedIn post after its honeypot network caught real intrusions using a proof-of-concept exploit that had just gone public. The firm separately warned on X that it was stealing machine keys to retain long-term access against on-premises deployments.

Security firm Defused Cyber captured similar traffic hitting SharePoint’s sign-in endpoint. “The captured requests carry no authentication material, matching 50522’s unauthenticated profile,” the firm said, a detail that sits at odds with Microsoft’s own advisory language about a Site Owner needing to be logged in already, and points to attackers finding an easier way through. Defused Cyber flagged the same activity earlier on X, describing an undocumented deserialization vector on its honeypots before pinning it to this CVE.

BleepingComputer reported that the public proof-of-concept, credited to researcher Janggggg, delivers a malicious .NET payload disguised as a forged security token cookie inside a sign-in response posted to SharePoint’s trust endpoint. An attacker holding the machine keys that result can forge valid authentication tokens, impersonate any user on the farm, including administrators, and walk back onto the server even after the underlying code is patched.

From Contest Stage to Criminal Exploit

CVE-2026-50522 did not start as a criminal discovery. It traces back to a stage in Berlin, where DEVCORE’s splitline chained two bugs together to compromise a default SharePoint installation, part of a Pwn2Own event where DEVCORE swept the field and claimed the overall Master of Pwn title with over half a million dollars in winnings.

1. May 16, 2026: splitline of DEVCORE chains two SharePoint bugs on stage at Pwn2Own Berlin, earning a $100,000 payout for the SharePoint chain and 10 Master of Pwn points.
2. July 14, 2026: Microsoft’s Patch Tuesday fixes both halves of that chain, now tracked as CVE-2026-50522 and CVE-2026-58644, alongside a third SharePoint bug, CVE-2026-56164.
3. July 16, 2026: CISA adds CVE-2026-58644 to its Known Exploited Vulnerabilities catalog after confirming exploitation.
4. Around July 20 to 21, 2026: A public proof-of-concept for CVE-2026-50522 surfaces, and watchTowr and Defused Cyber report active exploitation within days, while the CVE itself remains off the KEV list.

Nine weeks passed between the contest stage and the patch. Barely a week passed between the patch and criminals using it for real.

Does This Flaw Reach SharePoint Online Too?

No. Every version Microsoft and researchers list as affected, Subscription Edition, 2019 and 2016, is a self-hosted, on-premises deployment. SharePoint Online, the cloud service bundled with Microsoft 365, runs on infrastructure Microsoft patches directly, and it is not on the affected list.

The exposure is still large. Internet security watchdog Shadowserver tracks close to 10,000 internet-facing SharePoint servers worldwide, with more than 800 of them still unpatched as of mid-July against two earlier 2026 bugs, CVE-2026-32201 and CVE-2026-45659, according to Shadowserver’s scanning data cited in security reporting. No public scan tally yet exists for CVE-2026-50522 specifically, since the exploitation only began days ago.

Low attack complexity, in practice, means a small IT shop running one internet-facing SharePoint farm faces the same odds as a Fortune 500 company running dozens. The vulnerability does not care how big the target is, only whether the server answers requests from the open internet.

Patched, But the Debate Isn’t Over

Microsoft and the researchers tracking exploitation do not agree on what “fixed” means here.

• Microsoft’s position: a spokesperson told Cybersecurity Dive that “the security update fully mitigates the issue, however rotating machine keys can be performed to further safeguard user environments,” framing key rotation as optional extra hygiene.
• watchTowr and CISA’s position: keys stolen before a server was patched stay valid afterward until an administrator actively rotates them, meaning the patch closes the door but does nothing about intruders who already copied a key to the lock.

CISA’s own guidance leans toward the researchers’ side. The agency has told administrators who cannot patch immediately to monitor affected SharePoint servers closely for signs of exploitation, on top of applying updates, language that assumes patching by itself is not the finish line.

The Same Machine-Key Trick Broke SharePoint Last July

In July 2025, Microsoft issued emergency guidance for two SharePoint bugs, CVE-2025-53770 and CVE-2025-53771, after they were chained with earlier flaws in a campaign the industry called ToolShell. The technique was almost identical to this year’s: steal the server’s ASP.NET machine keys, then forge tokens that SharePoint accepts as legitimate.

Microsoft’s own security team wrote at the time that it had observed two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon, exploiting these vulnerabilities against internet-facing SharePoint servers, and separately flagged a third China-based group, Storm-2603, using the same access to deploy ransomware.

Reporting at the time, citing Imperva and Ars Technica, named the U.S. National Nuclear Security Administration, the agency responsible for maintaining the country’s nuclear weapons stockpile, among the victims. One security firm’s mapping of the campaign counted nearly 150 breached organizations before the dust settled.

Five Cracks in the Same Software Inside One Year

CVE-2026-50522 is not an isolated event even within 2026. CISA has now confirmed active exploitation of five separate SharePoint Server vulnerabilities this year, and the agency’s broader count is worse: since November 2021, it has flagged 11 SharePoint bugs exploited in attacks, seven of them also used to deliver ransomware.

The gap in that last row is the detail worth sitting with. CVE-2026-58644 came from the exact same Pwn2Own chain and reached the KEV catalog within two days of patching. Its twin, CVE-2026-50522, is already being used against real servers and still has not been added, according to watchTowr’s most recent update.

Thousands of Servers Are Still Sitting Exposed

Across all five bugs, the population at risk is the same aging pool of on-premises farms that Shadowserver counts in the thousands. CISA’s recommended fixes go beyond the patch itself.

• Rotate ASP.NET and IIS machine keys, along with any credentials that may have touched an exposed farm.
• Restrict SharePoint Central Administration and farm database traffic from reaching the open internet.
• Place internet-facing SharePoint farms behind a Layer 7 reverse proxy or similar control where exposure cannot be removed.
• Watch IIS logs for unexpected POST requests to sign-in endpoints such as /_trust/default.aspx.

Shadowserver’s count updates daily. This week it still shows thousands of on-premises SharePoint servers reachable from the open internet, waiting for whichever exploit lands next.

Frequently Asked Questions

Is Microsoft SharePoint Online affected by CVE-2026-50522?

No. The flaw only hits self-hosted, on-premises deployments, Subscription Edition, 2019 and 2016. SharePoint Online, the cloud service inside Microsoft 365, runs on infrastructure Microsoft patches directly and is not on the affected list.

What is a SharePoint machine key, and why does stealing one matter?

A machine key is a cryptographic value ASP.NET uses to sign and encrypt session data, including authentication tokens. Anyone holding a farm’s keys can forge tokens SharePoint trusts, log in as any user without a password, and keep that access even after the server is patched, since a patch fixes the vulnerable code but does not invalidate keys already copied off the box.

Has CISA added CVE-2026-50522 to its Known Exploited Vulnerabilities catalog?

Not as of watchTowr’s most recent update, which flagged the CVE as still absent from the catalog despite confirmed in-the-wild exploitation. Its Pwn2Own sibling, CVE-2026-58644, made the list within two days of patching, which makes the gap unusual.

Is CVE-2026-50522 related to the bug demonstrated at Pwn2Own Berlin?

Yes. DEVCORE researcher splitline chained two SharePoint bugs on stage in May 2026 to win $100,000. Microsoft’s July patch batch fixed both halves of that chain, now tracked separately as CVE-2026-50522 and CVE-2026-58644.

What should SharePoint administrators do beyond installing the patch?

Rotate ASP.NET machine keys and any credentials that may have touched an exposed farm, restrict SharePoint Central Administration from the open internet, and check IIS logs for unexpected POST requests to sign-in endpoints like /_trust/default.aspx, the path tied to the published proof-of-concept.