{"id":"sharepoint-deserialisation-attacks-jul-2026","category":"patch","status":"closed","title":"Microsoft SharePoint Server deserialisation flaw CVE-2026-50522 exploited; fixes available","tldr":"Attackers exploited CVE-2026-50522 to run code on organisations’ own SharePoint servers and steal server keys. Fixes cover all three affected editions. Ask IT to update, check for compromise and rotate exposed credentials and machine keys.","summary":"CVE-2026-50522 is a critical flaw in Microsoft SharePoint Server’s handling of untrusted data that lets an attacker run code remotely without signing in. It affects organisations running SharePoint Enterprise Server 2016, SharePoint Server 2019 or SharePoint Server Subscription Edition. Microsoft disclosed it on 14 July 2026, with fixes available for all three editions. Active exploitation was reported by 21 July, and CISA added it to its exploited-flaw catalogue the next day. NHS England reported theft of server machine keys, while CERT-FR warned that stolen secrets could let attackers regain access after patching. Exposed organisations therefore need to investigate and rotate secrets as well as update. CERT-FR closed its alert on 22 September but said the threat had not ended. SharePoint 2016 and 2019 reached the end of support on 14 July; organisations should migrate to a supported edition.","action":"If your business or family office runs its own SharePoint server, ask its IT provider to install the latest security updates and check for compromise. Internet-facing servers need credential rotation, and suspected compromise also calls for ASP.NET machine-key rotation because stolen keys can preserve access after patching. Ask IT to migrate SharePoint 2016 or 2019 to a supported edition.","product":"Microsoft SharePoint Server","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-50522"],"tags":["microsoft","sharepoint","server","remote-code-execution","actively-exploited"],"affected":["Microsoft SharePoint Enterprise Server 2016: 16.0.0 to before 16.0.5561.1001","Microsoft SharePoint Server 2019: 16.0.0 to before 16.0.10417.20175","Microsoft SharePoint Server Subscription Edition: 16.0.0 to before 16.0.19725.20434"],"fixed":["Microsoft SharePoint Enterprise Server 2016: 16.0.5561.1001","Microsoft SharePoint Server 2019: 16.0.10417.20175","Microsoft SharePoint Server Subscription Edition: 16.0.19725.20434"],"matches":[],"sources":[{"kind":"advisory","title":"Microsoft CVE record: SharePoint Remote Code Execution Vulnerability","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json","by":"Microsoft; CISA contribution","date":"2026-10-28"},{"kind":"advisory","title":"Critical Vulnerability CVE-2026-50522 in Microsoft SharePoint Server Under Exploitation","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4818","by":"NHS England","date":"2026-07-22"},{"kind":"advisory","title":"Multiples vulnérabilités dans Microsoft Sharepoint","url":"https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-008/","by":"CERT-FR","date":"2026-09-22"}],"started":"2026-07-14","closed":"2026-09-22","created":"2026-11-03T22:20:27.719Z","updated":"2026-11-03T22:20:27.719Z","cve_notes":[{"cve":"CVE-2026-50522","name":"Untrusted-data deserialisation in SharePoint Server","what":"SharePoint Server unsafely processes untrusted serialised data, allowing an attacker to run code over a network without signing in.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-09-22","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"CERT-FR closed its SharePoint alert but explicitly warned that closure did not mean the threat had ended. Servers still needed the security updates.","url":"https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-008/","by":"CERT-FR","patch":null},{"at":"2026-07-22","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"NHS England warned that attackers had stolen SharePoint machine keys. It instructed organisations to update affected servers and rotate credentials on internet-facing servers.","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4818","by":"NHS England","patch":null},{"at":"2026-07-22","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-50522 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks.","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json","by":"CISA (CVE record contribution)","patch":null},{"at":"2026-07-21","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Security company watchTowr reported active exploitation, according to CERT-FR. Stolen server secrets could let attackers return after an update.","url":"https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-008/","by":"CERT-FR","patch":null},{"at":"2026-07-14","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Microsoft disclosed CVE-2026-50522 and released SharePoint security updates in its July monthly update. The flaw allows attackers to run code remotely without signing in.","url":"https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-008/","by":"CERT-FR","patch":"patched"}],"url":"https://hard.fyi/live/sharepoint-deserialisation-attacks-jul-2026/","json":"https://hard.fyi/api/live?id=sharepoint-deserialisation-attacks-jul-2026"}