NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Microsoft SharePoint Server deserialisation flaw CVE-2026-50522 exploited; fixes available

Attackers exploited CVE-2026-50522 to run code on organisations’ own SharePoint servers and steal server keys. Fixes cover all three affected editions. Ask IT to update, check for compromise and rotate exposed credentials and machine keys.

What to do

If your business or family office runs its own SharePoint server, ask its IT provider to install the latest security updates and check for compromise. Internet-facing servers need credential rotation, and suspected compromise also calls for ASP.NET machine-key rotation because stolen keys can preserve access after patching. Ask IT to migrate SharePoint 2016 or 2019 to a supported edition.

What’s happening

CVE-2026-50522 is a critical flaw in Microsoft SharePoint Server’s handling of untrusted data that lets an attacker run code remotely without signing in. It affects organisations running SharePoint Enterprise Server 2016, SharePoint Server 2019 or SharePoint Server Subscription Edition. Microsoft disclosed it on 14 July 2026, with fixes available for all three editions. Active exploitation was reported by 21 July, and CISA added it to its exploited-flaw catalogue the next day. NHS England reported theft of server machine keys, while CERT-FR warned that stolen secrets could let attackers regain access after patching. Exposed organisations therefore need to investigate and rotate secrets as well as update. CERT-FR closed its alert on 22 September but said the threat had not ended. SharePoint 2016 and 2019 reached the end of support on 14 July; organisations should migrate to a supported edition.

What
Flaw
Affects
Microsoft SharePoint Server
Affected
Microsoft SharePoint Enterprise Server 2016: 16.0.0 to before 16.0.5561.1001
Microsoft SharePoint Server 2019: 16.0.0 to before 16.0.10417.20175
Microsoft SharePoint Server Subscription Edition: 16.0.0 to before 16.0.19725.20434
Fixed in
Microsoft SharePoint Enterprise Server 2016: 16.0.5561.1001
Microsoft SharePoint Server 2019: 16.0.10417.20175
Microsoft SharePoint Server Subscription Edition: 16.0.19725.20434
CVE
CVE-2026-50522
Since
14 July 2026
Closed
22 Sept 2026

Timeline

  1. Update

    CERT-FR closed its SharePoint alert but explicitly warned that closure did not mean the threat had ended. Servers still needed the security updates.

  2. Update

    NHS England warned that attackers had stolen SharePoint machine keys. It instructed organisations to update affected servers and rotate credentials on internet-facing servers.

  3. CISA added

    CISA added CVE-2026-50522 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks.

  4. Wider attacks

    Security company watchTowr reported active exploitation, according to CERT-FR. Stolen server secrets could let attackers return after an update.

  5. Made publicFixed

    Microsoft disclosed CVE-2026-50522 and released SharePoint security updates in its July monthly update. The flaw allows attackers to run code remotely without signing in.

Sources

  1. Microsoft CVE record: SharePoint Remote Code Execution VulnerabilityMicrosoft; CISA contribution · 28 Oct 2026
  2. Critical Vulnerability CVE-2026-50522 in Microsoft SharePoint Server Under ExploitationNHS England · 22 July 2026
  3. Multiples vulnérabilités dans Microsoft SharepointCERT-FR · 22 Sept 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from July 2026 · JSON · RSS