# CVE-2026-50522 Enterprise CTI Investigation Report

**Vulnerability:** CVE-2026-50522 — Microsoft SharePoint Remote Code Execution  
**Report Version:** 1.0  
**Author:** Pratik Chhetri  
**Report Date:** 2026-07-27  
**Evidence Collection Timestamp:** 2026-07-27T21:20:00+05:30 / 2026-07-27T15:50:00Z  
**Scope:** Publicly available official advisories, vulnerability databases, exploit-intelligence sources, GitHub metadata, and defensive documentation. No exploitation or validation against live targets was performed.

---

## 1. Executive Summary

CVE-2026-50522 is a **Critical remote code execution vulnerability in on-premises Microsoft SharePoint Server** caused by **deserialization of untrusted data**. Microsoft, CVE.org, and NVD describe the issue as allowing an unauthorized attacker to execute code over a network. Microsoft assigns **CVSS v3.1 9.8 Critical** with vector `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` [E1][E2][E3].

CISA added CVE-2026-50522 to the **Known Exploited Vulnerabilities catalog** on **2026-07-22**, with a due date of **2026-07-25**, and lists ransomware usage as **Unknown** [E4]. FIRST EPSS on 2026-07-27 reported **EPSS 0.571010** and **98.974 percentile**, indicating elevated probability of exploitation activity [E5].

The affected products are **Microsoft SharePoint Enterprise Server 2016**, **Microsoft SharePoint Server 2019**, and **Microsoft SharePoint Server Subscription Edition**, before the fixed builds listed by Microsoft [E1][E2]. Public reporting from BleepingComputer, citing watchTowr and Defused, states that public proof-of-concept exploit code became available around **2026-07-20**, followed by exploitation attempts against on-premises SharePoint deployments and reported theft of SharePoint/IIS machine keys [E13]. NHS England independently warned that exploitation had been reported and that successful attempts involved attackers obtaining SharePoint Server machine keys via a single request [E14].

**Management impact:** Internet-facing or broadly reachable on-premises SharePoint servers should be treated as an emergency exposure. Successful exploitation may enable remote code execution, theft of machine keys, forged authentication tokens, access to SharePoint sites/documents, persistence that can survive patching, malware deployment, and follow-on enterprise compromise.

**Immediate actions:**

1. Identify all on-premises SharePoint farms, especially internet-facing systems.
2. Apply the July 2026 SharePoint security updates to every server in every farm.
3. Verify fixed build levels.
4. Preserve and review logs before making destructive changes.
5. Hunt for exploitation, web shells, suspicious `w3wp.exe` activity, and machine-key access.
6. Rotate machine keys and exposed credentials **after** confirming attacker artifacts are removed.
7. Enable/verify AMSI integration and request body scanning where supported.
8. Remove direct internet exposure or place SharePoint behind an authenticated Layer 7 reverse proxy/WAF.

**Risk rating:** Critical / P0 for internet-facing on-premises SharePoint; High / P1 for internal-only SharePoint with broad user reach.  
**Analyst confidence:** 9/10 for vulnerability existence, affected products, patch availability, KEV status, and active exploitation status. 7/10 for exact exploit path details because Microsoft, ZDI, and public reporting provide partial and partly conflicting prerequisite descriptions.

---

## 2. Technical Analysis

### 2.1 Official CVE Identification

| Field | Finding | Evidence | Confidence |
|---|---|---:|---:|
| CVE | CVE-2026-50522 | CVE.org, MSRC, NVD [E1][E2][E3] | High |
| Vendor | Microsoft | MSRC/CVE.org/NVD [E1][E2][E3] | High |
| Product family | Microsoft Office SharePoint / SharePoint Server | MSRC/NVD [E1][E3] | High |
| Impact | Remote Code Execution | MSRC [E1] | High |
| Weakness | CWE-502: Deserialization of Untrusted Data | MSRC/CVE.org/NVD [E1][E2][E3] | High |
| CVSS v3.1 | 9.8 Critical | MSRC/CVE.org/NVD [E1][E2][E3] | High |
| CVSS vector | `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` | MSRC/CVE.org/NVD [E1][E2][E3] | High |
| MSRC temporal score | 8.5; vector includes `E:U/RL:O/RC:C` at original publication | MSRC [E1] | High |
| EPSS | 0.571010; percentile 0.989740; date 2026-07-27 | FIRST EPSS API [E5] | High |
| KEV | Present in CISA KEV; date added 2026-07-22; due 2026-07-25 | CISA [E4] | High |
| Ransomware use | Unknown | CISA KEV [E4] | High |

### 2.2 Affected Products, Versions, and Fixed Builds

| Product | Affected versions | Fixed build / patch | Evidence | Confidence |
|---|---|---|---|---:|
| Microsoft SharePoint Enterprise Server 2016 / SharePoint Server 2016 | From `16.0.0` before `16.0.5561.1001` | KB5002891, build `16.0.5561.1001` | MSRC/CVE.org/Microsoft Support [E1][E2][E10] | High |
| Microsoft SharePoint Server 2019 | From `16.0.0` before `16.0.10417.20175` | KB5002883, build `16.0.10417.20175` | MSRC/CVE.org/Microsoft Support [E1][E2][E9] | High |
| Microsoft SharePoint Server Subscription Edition | From `16.0.0` before `16.0.19725.20434` | KB5002882, build `16.0.19725.20434` | MSRC/CVE.org/Microsoft Support [E1][E2][E8] | High |
| SharePoint Online / Microsoft 365 | Not identified as customer-action scope in Microsoft on-prem advisory. Censys notes Microsoft patches cloud service centrally. | No customer on-prem patch action indicated by Censys for SharePoint Online. | Censys [E15] | Medium |

**Lifecycle note:** NHS England states that SharePoint Server 2016 and 2019 reached end of support as of 2026-07-14 and recommends migration to a supported version [E14].

### 2.3 CPE Validation

NVD identifies the following vulnerable software configurations [E3]:

| CPE | NVD status | Notes | Confidence |
|---|---|---|---:|
| `cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*` | Vulnerable up to, excluding `16.0.19725.20434` | Subscription Edition | High |
| `cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*` | Vulnerable | CVE.org gives version range before `16.0.5561.1001` | High |
| `cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*` | Vulnerable | CVE.org gives version range before `16.0.10417.20175` | High |

### 2.4 Root Cause

ZDI identifies the vulnerable area as the **`SessionSecurityTokenHandler` class** and states that the issue results from a lack of proper validation of user-supplied data, causing deserialization of untrusted data. ZDI further states that authentication is not required, and code execution occurs in the context of the service account when leveraged with other vulnerabilities [E6].

Microsoft/CVE.org describe the weakness as **deserialization of untrusted data in Microsoft Office SharePoint** allowing an unauthorized attacker to execute code over a network [E1][E2].

**Root-cause conclusion:** SharePoint processes attacker-controlled serialized/token-related input in a way that can reach unsafe deserialization. In vulnerable builds, insufficient validation permits attacker-controlled object data to be deserialized and used to trigger remote code execution.

**Confidence:** High for weakness class and affected component family; Medium for exact internal call path because SharePoint source and patch diff are not public.

### 2.5 Exploitation Mechanics

Publicly reported exploit flow, based on BleepingComputer reporting of a public PoC, is as follows [E13]:

1. The attacker sends a crafted WS-Federation sign-in response to SharePoint.
2. The request is posted to the SharePoint sign-in endpoint `/_trust/default.aspx`.
3. The payload uses a forged `SecurityContextToken` carrying a malicious .NET `BinaryFormatter` serialized payload.
4. If the vulnerable deserialization path processes the token, arbitrary code executes on the SharePoint server.

ZDI confirms the vulnerable class and the deserialization root cause but does not publish exploit code [E6]. CISA and NHS confirm exploitation status but do not publish request-level details [E4][E14].

### 2.6 Attack Prerequisites and Noted Documentation Conflict

| Prerequisite | Evidence | Assessment | Confidence |
|---|---|---|---:|
| Network reachability to vulnerable SharePoint | CVSS AV:N; MSRC says remotely exploitable and exploitable from the internet [E1] | Required | High |
| Vulnerable on-premises SharePoint build | MSRC/CVE.org affected versions [E1][E2] | Required | High |
| Privileges | MSRC/CVE.org/NVD vector uses PR:N; ZDI says authentication is not required; CISA/NHS describe unauthorized/unauthenticated impact [E1][E2][E3][E4][E6][E14] | Treat as unauthenticated for risk management | High |
| Conflicting MSRC FAQ text | MSRC FAQ states an attacker authenticated as at least Site Owner could write arbitrary code [E1] | Documentation conflict. Because official CVSS PR:N, CVE description, ZDI, CISA, and NHS support no-auth posture, do not rely on authentication as a barrier. | Medium |
| User interaction | CVSS UI:N [E1][E2][E3] | Not required | High |
| Chaining | ZDI states leverage “in conjunction with other vulnerabilities” [E6]; Microsoft CVSS AC:L [E1] | Exact chain requirement is not fully public; assume repeatable exploitation due to KEV and public PoC reporting. | Medium |

### 2.7 Attack Vector and Impact

**Attack vector:** Network, low complexity, no privileges, no user interaction per Microsoft CVSS [E1].  
**Execution context:** ZDI states code execution occurs in the context of the SharePoint service account [E6].  
**Observed post-exploitation objective:** Machine-key theft. BleepingComputer and NHS report attackers stealing machine keys; BleepingComputer explains that stolen machine keys can allow forging authentication tokens to impersonate users and access SharePoint resources [E13][E14].  
**Enterprise impact:** Confidentiality, integrity, and availability are all high per CVSS [E1]. Practical impact includes document exposure, token forgery, persistent access, malware deployment, and possible pivoting from SharePoint to broader Windows/Active Directory infrastructure.

### 2.8 Patch Diff and Source-Code Review

| Item | Result | Evidence | Confidence |
|---|---|---|---:|
| Public SharePoint source code | Not Found | SharePoint is proprietary; no public source located during investigation. | High |
| Public vendor patch diff | Not Found | Microsoft publishes packages and file lists, not a source-level diff for this issue. | High |
| Public root-cause statement | Found | ZDI: `SessionSecurityTokenHandler`, insufficient validation, unsafe deserialization [E6]. | High |
| Public exploit implementation | Reported; not executed | BleepingComputer reports a public PoC; GitHub search found repositories referencing the CVE [E13][E17]. | Medium |

### 2.9 Official Patch Packages and Validation Hashes

These hashes are **benign Microsoft update package hashes** for patch validation, not malicious indicators.

| Product | KB | Package | SHA256 | Evidence |
|---|---|---|---|---|
| SharePoint Server Subscription Edition | KB5002882 | `uber-subscription-kb5002882-fullfile-x64-glb.exe` | `45CA5B642F452D7142557159811E14327A27DC089C93BA1262275FD5008EBCBC` | Microsoft Support [E8] |
| SharePoint Server 2019 | KB5002883 | `sts2019-kb5002883-fullfile-x64-glb.exe` | `8DFB3B0C94BAF82909F69FAEFDD1AFF3FA9431EEDD065E1D0419CCE209BE0603` | Microsoft Support [E9] |
| SharePoint Server 2016 | KB5002891 | `sts2016-kb5002891-fullfile-x64-glb.exe` | `4945A33BB7359707D8E0894C85487EB5EC6D01F2C80948CF0270D6144DFDD9C0` | Microsoft Support [E10] |

---

## 3. Timeline

| Date / time | Event | Evidence | Confidence |
|---|---|---|---:|
| 2026-05-21 | Vulnerability reported to vendor via ZDI/Pwn2Own path. | ZDI disclosure timeline [E6] | High |
| 2026-07-14 | Microsoft released CVE-2026-50522 advisory and security updates. | MSRC [E1] | High |
| 2026-07-14 | NVD published CVE record. | NVD quick info [E3] | High |
| 2026-07-14 | Microsoft Support KBs published July 2026 SharePoint updates. | KB5002882/5002883/5002891 [E8][E9][E10] | High |
| 2026-07-15 | ZDI advisory ZDI-26-412 publicly released/updated. | ZDI [E6] | High |
| 2026-07-16 | CISA SharePoint hardening alert updated for related SharePoint exploitation, recommending patching, AMSI, machine-key hunting/rotation, and exposure reduction. | CISA alert [E7] | High |
| 2026-07-17 | Censys advisory stated no confirmed CVE-2026-50522 exploitation as of 2026-07-16 and estimated about 1,500 on-prem SharePoint hosts among roughly 334,000 SharePoint web properties. | Censys [E15] | High for that date |
| 2026-07-17 | Defused reportedly observed an undocumented SharePoint deserialization vector later assessed likely CVE-2026-50522. | BleepingComputer reporting [E13] | Medium |
| 2026-07-20 | Public PoC reportedly became available; watchTowr reportedly observed exploitation within hours. | BleepingComputer [E13] | Medium-High |
| 2026-07-21 | BleepingComputer reported active exploitation to steal machine keys and a public PoC. | BleepingComputer [E13] | Medium-High |
| 2026-07-22 | CISA added CVE-2026-50522 to KEV. | CISA KEV [E4] | High |
| 2026-07-22 | NHS England issued high-severity alert reporting exploitation and required patching plus credential rotation on internet-facing SharePoint servers. | NHS England [E14] | High |
| 2026-07-25 | CISA KEV due date for required action. | CISA KEV [E4] | High |
| 2026-07-27 | CVE.org record updated; FIRST EPSS reported EPSS 0.571010. | CVE.org/FIRST [E2][E5] | High |

---

## 4. Threat Intelligence

### 4.1 Exploitation Status

| Question | Finding | Evidence | Confidence |
|---|---|---|---:|
| Is it exploited in the wild? | Yes. CISA KEV lists CVE-2026-50522 and CISA states KEV entries are based on evidence of active exploitation. | CISA KEV and CISA alert [E4] | High |
| Did Microsoft mark it exploited at original publication? | No. MSRC original exploitability table says “Exploited: No” and “Exploitation More Likely.” | MSRC [E1] | High |
| Has public reporting observed exploitation? | Yes. watchTowr and Defused are cited by BleepingComputer as observing exploitation; NHS reports security researchers have reported exploitation. | BleepingComputer/NHS [E13][E14] | Medium-High |
| Is ransomware usage known? | Unknown. | CISA KEV [E4] | High |
| Is a named APT or ransomware group attributed? | Not Found. | Searches across public sources during this investigation did not identify a named actor tied specifically to CVE-2026-50522. | Medium |

### 4.2 Public Exploit and PoC Status

| Source area | Finding | Evidence | Confidence |
|---|---|---|---:|
| Public PoC | Reported as available around 2026-07-20. BleepingComputer states at least one PowerShell demonstrative exploit was available on GitHub from researcher Janggggg; BleepingComputer did not test it but considered it structurally and technically legitimate. | BleepingComputer [E13] | Medium |
| GitHub search | GitHub repository search for `CVE-2026-50522` returned two repositories as of collection time: `4minx/CVE-2026-50522` and `HORKimhab/CVE-2026-50522`. The exact Janggggg repository referenced by public reporting was not found via unauthenticated GitHub repository search during this investigation. | GitHub API via Bash [E17] | Medium |
| Exploit-DB | Not Found. Search of Exploit-DB public CSV did not contain `CVE-2026-50522`. | Exploit-DB CSV via Bash [E18] | Medium-High |
| Metasploit | Not Found. GitHub issue/search queries against `rapid7/metasploit-framework` for CVE-2026-50522 returned zero results during collection. | GitHub API via Bash [E19] | Medium |
| ZDI/Pwn2Own | Working exploit knowledge existed privately through Pwn2Own/ZDI path; ZDI published advisory but no exploit code. | ZDI [E6] | High |

### 4.3 Exploit Maturity Assessment

| Stage | Assessment | Evidence | Confidence |
|---|---|---|---:|
| Vendor-confirmed vulnerability | Confirmed | MSRC, CVE.org, NVD [E1][E2][E3] | High |
| Private working exploit | Confirmed through ZDI/Pwn2Own reporting | ZDI [E6] | High |
| Public PoC | Reported and GitHub repositories found | BleepingComputer/GitHub API [E13][E17] | Medium |
| Active exploitation | Confirmed by CISA KEV; reported by NHS/watchTowr/Defused | CISA/NHS/BleepingComputer [E4][E13][E14] | High |
| Weaponization at scale | Likely for internet-exposed systems due to public PoC + KEV + EPSS 57.1%, but scale of compromise not quantified in official sources. | CISA/FIRST/Censys [E4][E5][E15] | Medium-High |

### 4.4 Threat Actor Likelihood Analysis

| Actor class | Likelihood | Rationale | Confidence |
|---|---:|---|---:|
| Opportunistic scanners / exploit brokers | High | Internet-facing SharePoint is discoverable; public PoC and KEV status compress defender response time. | Medium-High |
| Criminal access brokers | High | Machine-key theft can enable persistent access and credential/token abuse, valuable for sale or follow-on intrusion. | Medium |
| Ransomware operators | Medium | CISA ransomware field is Unknown for this CVE; SharePoint RCE and machine-key persistence are useful in ransomware attack paths, but no campaign is verified for CVE-2026-50522. | Medium |
| State-linked actors | Medium | SharePoint has high-value enterprise data and identity links; no named actor is verified for this CVE in collected sources. | Low-Medium |

### 4.5 Asset Exposure Estimation

Censys observed roughly **334,000 SharePoint web properties**, almost all SharePoint Online, and about **1,500 self-managed on-premises SharePoint hosts** exposed on the internet. Censys notes that cloud-hosted servers may still be customer-managed on-prem editions and that header-based patch determination has limitations because the `MicrosoftSharePointTeamServices` header does not always expose enough revision detail to conclusively determine patch status [E15].

**Enterprise interpretation:** Any on-premises SharePoint server reachable from the internet should be prioritized as a critical exposure. Internal SharePoint servers reachable by many users or partners remain high risk due to low-complexity network exploitation and possible post-exploitation credential/token abuse.

---

## 5. IOC Table

**Important:** No attacker IP addresses, domains, malicious file hashes, registry keys, mutexes, or malware samples uniquely tied to CVE-2026-50522 were verified in the collected sources. The table below separates verified attack artifacts from defensive context. Microsoft patch hashes are listed in Section 2.9 and are not malicious IOCs.

| Type | Indicator / artifact | Role | Source | Confidence | Notes |
|---|---|---|---|---:|---|
| URL path | `/_trust/default.aspx` | Reported target endpoint in public PoC / SharePoint sign-in flow | BleepingComputer [E13] | Medium-High | Use for HTTP/IIS/WAF hunting; benign WS-Fed traffic may exist. |
| HTTP method + path | `POST /_trust/default.aspx` | Reported exploit delivery pattern | BleepingComputer [E13] | Medium | Inspect request body where lawful and available. |
| Token/string | `SecurityContextToken` | Public PoC artifact in forged token/cookie | BleepingComputer [E13] | Medium | Useful as a hunting string, not a unique IOC. |
| Payload class | `.NET BinaryFormatter` serialized payload | Reported public PoC technique; aligns with CWE-502 | BleepingComputer/ZDI [E13][E6] | Medium | Payload may be encoded/obfuscated. |
| Sensitive secret | ASP.NET / IIS machine keys: `validationKey`, `decryptionKey` | Targeted credential material; theft enables token forgery/persistence | BleepingComputer/NHS/Microsoft Learn [E13][E14][E11] | High | Treat as credential material; rotate after cleanup. |
| Process context | `w3wp.exe` | IIS/SharePoint worker process likely execution context; monitor child processes and memory loads | CISA hardening guidance references suspicious SharePoint worker-process activity [E7] | Medium-High | Legitimate process; alert on abnormal child processes, outbound connections, module loads. |
| Defender/AMSI detection | `Exploit:Script/SuspSignoutReqBody.A` | CISA-recommended detection for observed SharePoint exploitation attempts | CISA [E7] | High | SharePoint Server Subscription body scanning coverage. |
| Defender/AMSI detection | `Exploit:Script/ToolPaneAuthBypass.A` | CISA SharePoint exploitation/hardening detection | CISA [E7] | High | Related SharePoint exploit coverage, not unique to this CVE. |
| Defender/AMSI detection | `Exploit:Script/ToolPaneAuthBypass.C` | CISA RCE coverage for SharePoint 2016/2019/Subscription | CISA [E7] | High | Related SharePoint exploit coverage, not unique to this CVE. |
| Defender detection | `Backdoor:MSIL/LeakFang.A!dha` | Post-exploitation activity involving IIS-protected secrets | CISA [E7] | High | Treat as incident indicator. |
| IP addresses | Not Found | No verified attacker IPs | Collected sources | High | Do not block based on unverified lists. |
| Domains | Not Found | No verified attacker domains | Collected sources | High | Not Found. |
| URLs beyond path | Not Found | No full malicious URLs verified | Collected sources | High | Not Found. |
| Malicious file hashes | Not Found | No malware sample hashes verified | Collected sources | High | Patch package hashes are benign and listed separately. |
| Registry keys | Not Found | No registry artifacts verified | Collected sources | High | Not Found. |
| Mutexes | Not Found | No mutex artifacts verified | Collected sources | High | Not Found. |
| CVE-specific filenames | Not Found | No web shell filename uniquely tied to CVE-2026-50522 verified | Collected sources | Medium-High | Hunt for new/modified `.aspx`, `.ashx`, `.asmx`, `.dll`, and web.config changes. |

---

## 6. MITRE ATT&CK Mapping

| Tactic | Technique | Applicability | Evidence | Confidence |
|---|---|---|---|---:|
| Initial Access | **T1190 — Exploit Public-Facing Application** | Exploitation of internet-reachable/on-prem SharePoint to gain unauthorized access/RCE. | MSRC network RCE; CISA KEV active exploitation [E1][E4] | High |
| Execution | **T1059 — Command and Scripting Interpreter** | Expected/likely follow-on after RCE if attackers spawn `cmd.exe`, PowerShell, or similar under `w3wp.exe`. | RCE confirmed; CISA recommends reviewing worker-process activity [E1][E7] | Medium |
| Persistence | **T1550.004 — Use Alternate Authentication Material: Web Session Cookie** | Stolen machine keys can allow forged authentication material or tokens, preserving access after patching. | BleepingComputer machine-key/token-forgery explanation [E13] | Medium-High |
| Persistence | **T1606 — Forge Web Credentials** / **T1606.001 — Web Cookies** | Machine-key theft enables creation of valid authentication tokens/cookies for SharePoint identities. | BleepingComputer [E13] | Medium-High |
| Persistence | **T1505.003 — Server Software Component: Web Shell** | CISA recommends hunting for webshells in SharePoint exploitation. No CVE-50522-specific web shell filename verified. | CISA hardening guidance [E7] | Medium |
| Privilege Escalation | Not Found | No distinct privilege escalation technique verified for CVE-2026-50522 beyond RCE/service-account context and token impersonation. | Collected sources | Medium |
| Defense Evasion | **T1550 / T1606 token abuse** | Forged tokens may appear legitimate and bypass simple patch-only remediation. | BleepingComputer/NHS [E13][E14] | Medium |
| Credential Access | **T1552 — Unsecured Credentials** / **T1552.001 — Credentials In Files** | Attackers reportedly obtain SharePoint/IIS machine keys; machine keys are credential-like cryptographic secrets. | BleepingComputer/NHS/CISA [E13][E14][E7] | Medium-High |
| Discovery | Not Found | No verified discovery behavior specific to this CVE. | Collected sources | High |
| Lateral Movement | Not Found | SharePoint compromise can enable lateral movement, but no CVE-specific lateral movement behavior was verified. | Collected sources | Medium |
| Collection | **T1213.002 — Data from Information Repositories: SharePoint** | Forged tokens may allow access to SharePoint sites/documents available to impersonated users. | BleepingComputer [E13] | Medium |
| Exfiltration | Not Found | No verified exfiltration channel or stolen dataset beyond machine-key theft reporting. | Collected sources | Medium-High |
| Impact | Not Found | No ransomware or destructive impact verified for this CVE; CISA ransomware field is Unknown. | CISA KEV [E4] | High |

---

## 7. Detection Recommendations

### 7.1 Detection Coverage Matrix

| Data source | Detection objective | Example signals | Coverage | Confidence |
|---|---|---|---|---:|
| IIS/WAF/reverse proxy logs | Detect exploit delivery | `POST` to `/_trust/default.aspx`, unusual `SecurityContextToken`, large/encoded request body | High if bodies/headers are logged; Medium otherwise | Medium-High |
| SharePoint ULS logs | Detect authentication/token processing anomalies | Unexpected sign-in failures, token validation errors, unusual endpoint errors | Medium | Medium |
| EDR/Sysmon process events | Detect code execution | `w3wp.exe` spawning `cmd.exe`, `powershell.exe`, `pwsh.exe`, `certutil.exe`, `bitsadmin.exe`, `mshta.exe`, `rundll32.exe`, `cscript.exe`, `wscript.exe` | High | High |
| EDR/Sysmon network events | Detect post-exploitation | Outbound connections from SharePoint app pool identities / `w3wp.exe` to unknown destinations | Medium-High | Medium |
| File integrity monitoring | Detect persistence | New/modified `.aspx`, `.ashx`, `.asmx`, `.dll`, `web.config`, IIS module changes under SharePoint/IIS paths | High | Medium-High |
| Microsoft Defender/AMSI | Detect exploit attempts and post-exploitation | `Exploit:Script/SuspSignoutReqBody.A`, `ToolPaneAuthBypass.A/C`, `Backdoor:MSIL/LeakFang.A!dha` | High where enabled and updated | High |
| Vulnerability scanners | Detect exposure | Tenable plugins 327609/327610/327611; authenticated build checks | High for patch state | High |
| Network IDS | Detect cleartext or decrypted traffic | HTTP POST to `/_trust/default.aspx` with suspicious token strings | Medium; requires TLS visibility | Medium |

### 7.2 Sigma Rule Ideas

#### Sigma — Suspicious SharePoint WS-Federation Token POST

```yaml
title: Potential SharePoint CVE-2026-50522 Token Deserialization Attempt
id: 1b6949fd-50522-4cve-9c0a-sharepoint-trust-post
status: experimental
description: Detects suspicious POST requests to SharePoint /_trust/default.aspx with token/deserialization indicators.
author: Pratik Chhetri
date: 2026-07-27
references:
  - https://www.bleepingcomputer.com/news/security/critical-sharepoint-rce-flaw-exploited-to-steal-machine-keys/
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522
logsource:
  category: webserver
detection:
  selection_path:
    cs-method: POST
    cs-uri-stem|contains: '/_trust/default.aspx'
  selection_token:
    request_body|contains:
      - 'SecurityContextToken'
      - 'BinaryFormatter'
      - 'AAEAAAD'
    cs-cookie|contains: 'SecurityContextToken'
    cs-uri-query|contains: 'SecurityContextToken'
  condition: selection_path and selection_token
fields:
  - c-ip
  - cs-host
  - cs-method
  - cs-uri-stem
  - cs-uri-query
  - cs-user-agent
  - sc-status
falsepositives:
  - Federated authentication traffic may legitimately use /_trust/default.aspx; tune to environment and require unusual body size, status codes, or token indicators.
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.50522
```

#### Sigma — SharePoint IIS Worker Spawns Suspicious Process

```yaml
title: SharePoint IIS Worker Process Spawned Suspicious Child Process
id: d703af6b-50522-41fe-9b76-w3wp-child
status: test
description: Detects common post-exploitation process execution patterns from SharePoint/IIS worker process.
author: Pratik Chhetri
date: 2026-07-27
references:
  - https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: selection_parent and selection_child
fields:
  - UtcTime
  - Computer
  - User
  - ParentImage
  - Image
  - CommandLine
falsepositives:
  - Rare administrative scripts or maintenance tooling; validate known scheduled jobs.
level: critical
tags:
  - attack.execution
  - attack.t1059
  - cve.2026.50522
```

#### Sigma — New ASPX/DLL in SharePoint Web Paths

```yaml
title: New or Modified Executable Web Artifact in SharePoint Paths
id: c0d39c6c-50522-4cve-b1a7-sharepoint-web-artifact
status: experimental
description: Detects web shell or malicious module placement in common SharePoint/IIS locations.
author: Pratik Chhetri
date: 2026-07-27
references:
  - https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations
logsource:
  product: windows
  category: file_event
detection:
  selection_path:
    TargetFilename|contains:
      - '\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\'
      - '\inetpub\wwwroot\wss\VirtualDirectories\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.asmx'
      - '.dll'
      - 'web.config'
  condition: selection_path and selection_ext
fields:
  - UtcTime
  - Computer
  - User
  - Image
  - TargetFilename
falsepositives:
  - SharePoint updates, feature deployments, administrative changes. Suppress during approved maintenance windows after verifying file hashes.
level: high
tags:
  - attack.persistence
  - attack.t1505.003
  - cve.2026.50522
```

### 7.3 Wazuh Guidance

**Recommended telemetry:** IIS logs, Windows Security logs, Sysmon, Microsoft Defender alerts, SharePoint ULS logs, file integrity monitoring for SharePoint web roots and IIS configuration.

Example Wazuh rule ideas; adapt field names to local decoders:

```xml
<group name="sharepoint,cve_2026_50522,web,">
  <rule id="100522" level="12">
    <decoded_as>json</decoded_as>
    <field name="cs-method">POST</field>
    <field name="cs-uri-stem">/_trust/default.aspx</field>
    <description>Potential SharePoint CVE-2026-50522 request to WS-Federation endpoint</description>
    <mitre><id>T1190</id></mitre>
  </rule>

  <rule id="100523" level="14">
    <if_sid>100522</if_sid>
    <match>SecurityContextToken|BinaryFormatter|AAEAAAD</match>
    <description>Potential SharePoint CVE-2026-50522 token deserialization payload indicator</description>
    <mitre><id>T1190</id></mitre>
  </rule>
</group>

<group name="sharepoint,cve_2026_50522,process,">
  <rule id="100524" level="15">
    <if_group>sysmon_event1</if_group>
    <field name="win.eventdata.parentImage">\\w3wp.exe$</field>
    <field name="win.eventdata.image">\\(cmd|powershell|pwsh|certutil|bitsadmin|mshta|rundll32|regsvr32|cscript|wscript)\.exe$</field>
    <description>SharePoint IIS worker spawned suspicious process</description>
    <mitre><id>T1059</id></mitre>
  </rule>
</group>
```

### 7.4 Splunk SPL Queries

**IIS/WAF exploit attempt hunting**

```spl
index=web sourcetype IN ("ms:iis:auto","iis","w3c")
(cs_method=POST OR method=POST)
(cs_uri_stem="*/_trust/default.aspx*" OR uri_path="*/_trust/default.aspx*")
| eval payload=coalesce(request_body, http_request_body, cs_cookie, cookie, cs_uri_query, _raw)
| search payload="*SecurityContextToken*" OR payload="*BinaryFormatter*" OR payload="*AAEAAAD*"
| stats count min(_time) as firstTime max(_time) as lastTime values(sc_status) as status values(cs_user_agent) as user_agents by src_ip, host, cs_host, cs_uri_stem
| convert ctime(firstTime) ctime(lastTime)
```

**EDR/Sysmon post-exploitation via `w3wp.exe`**

```spl
index=endpoint (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security" OR sourcetype="edr")
(ParentImage="*\\w3wp.exe" OR ParentProcessName="w3wp.exe")
(Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\cscript.exe" OR Image="*\\wscript.exe")
| table _time host user ParentImage Image CommandLine ProcessId ParentProcessId
```

**Suspicious web artifact writes**

```spl
index=endpoint (EventCode=11 OR action IN (created,modified))
(TargetFilename="*\\Microsoft Shared\\Web Server Extensions\\16\\TEMPLATE\\LAYOUTS\\*" OR TargetFilename="*\\inetpub\\wwwroot\\wss\\VirtualDirectories\\*")
(TargetFilename="*.aspx" OR TargetFilename="*.ashx" OR TargetFilename="*.asmx" OR TargetFilename="*.dll" OR TargetFilename="*web.config")
| stats count min(_time) as firstTime max(_time) as lastTime values(Image) as writers values(TargetFilename) as files by host, user
| convert ctime(firstTime) ctime(lastTime)
```

**Microsoft Defender / AMSI detections**

```spl
index=security ("Exploit:Script/SuspSignoutReqBody.A" OR "Exploit:Script/ToolPaneAuthBypass.A" OR "Exploit:Script/ToolPaneAuthBypass.C" OR "Backdoor:MSIL/LeakFang.A!dha")
| table _time host user signature severity file_name process_name action
```

### 7.5 Microsoft Sentinel KQL

**IIS/WAF exploit attempt hunting**

```kql
W3CIISLog
| where TimeGenerated > ago(30d)
| where csMethod =~ "POST"
| where csUriStem has "/_trust/default.aspx"
| extend Payload = strcat(tostring(csUriQuery), " ", tostring(csCookie), " ", tostring(UserAgent), " ", tostring(RawData))
| where Payload has_any ("SecurityContextToken", "BinaryFormatter", "AAEAAAD")
| summarize Count=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), StatusCodes=make_set(scStatus), UserAgents=make_set(UserAgent) by cIP, Computer, csHost, csUriStem
```

**Defender for Endpoint process execution**

```kql
DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","certutil.exe","bitsadmin.exe","mshta.exe","rundll32.exe","regsvr32.exe","cscript.exe","wscript.exe","curl.exe","wget.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ReportId
```

**Suspicious file writes in SharePoint paths**

```kql
DeviceFileEvents
| where Timestamp > ago(30d)
| where FolderPath has_any ("\\Microsoft Shared\\Web Server Extensions\\16\\TEMPLATE\\LAYOUTS\\", "\\inetpub\\wwwroot\\wss\\VirtualDirectories\\")
| where FileName endswith ".aspx" or FileName endswith ".ashx" or FileName endswith ".asmx" or FileName endswith ".dll" or FileName =~ "web.config"
| project Timestamp, DeviceName, ActionType, FolderPath, FileName, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
```

**AMSI / Defender detections from CISA guidance**

```kql
SecurityAlert
| where TimeGenerated > ago(30d)
| where AlertName has_any ("Exploit:Script/SuspSignoutReqBody.A", "Exploit:Script/ToolPaneAuthBypass.A", "Exploit:Script/ToolPaneAuthBypass.C", "Backdoor:MSIL/LeakFang.A!dha")
| project TimeGenerated, AlertName, CompromisedEntity, Severity, ProviderName, Description, Entities
```

### 7.6 Snort / Suricata Network Signatures

**Use only where HTTP body is visible after TLS termination. Tune to local SharePoint authentication traffic.**

```snort
alert http any any -> $HOME_NET $HTTP_PORTS (msg:"POSSIBLE SharePoint CVE-2026-50522 WS-Fed token deserialization attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/_trust/default.aspx"; nocase; http.client_body; content:"SecurityContextToken"; nocase; classtype:web-application-attack; sid:26050522; rev:1; reference:cve,2026-50522; metadata:service http, attack_target server;)
```

```suricata
alert http any any -> $HOME_NET any (msg:"POSSIBLE SharePoint CVE-2026-50522 token deserialization attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/_trust/default.aspx"; nocase; http.request_body; content:"SecurityContextToken"; nocase; classtype:web-application-attack; sid:26050523; rev:1; reference:cve,2026-50522;)
```

### 7.7 YARA

No malware sample or malicious file hash uniquely tied to CVE-2026-50522 was found in the collected evidence. A CVE-specific YARA rule is therefore **Not Found**. Use web-shell and ASP.NET backdoor hunting rules already validated in the organization, and prioritize EDR/file-integrity logic for newly created `.aspx`, `.ashx`, `.asmx`, `.dll`, and suspicious `web.config` changes in SharePoint paths.

---

## 8. Mitigation

### 8.1 Official Patches

Apply Microsoft’s July 2026 SharePoint updates to **every server in every SharePoint farm** and complete required SharePoint post-update configuration steps.

| Product | Required fixed build | KB | Download / install path | Evidence |
|---|---|---|---|---|
| SharePoint Server Subscription Edition | `16.0.19725.20434` or later | KB5002882 | Microsoft Update, Update Catalog, Download Center | MSRC/Microsoft Support [E1][E8] |
| SharePoint Server 2019 | `16.0.10417.20175` or later | KB5002883 | Microsoft Update, Update Catalog, Download Center | MSRC/Microsoft Support [E1][E9] |
| SharePoint Server 2016 / Enterprise Server 2016 | `16.0.5561.1001` or later | KB5002891 | Microsoft Update, Update Catalog, Download Center | MSRC/Microsoft Support [E1][E10] |

### 8.2 Verification

1. Confirm installed SharePoint build on all farm members.
2. Confirm SharePoint Products Configuration Wizard / PSConfig was completed after binaries were installed.
3. Confirm no farm member remains on an affected build.
4. Validate update package hashes against Microsoft Support when using standalone installers [E8][E9][E10].
5. Use authenticated vulnerability scanners where available. Tenable lists plugins 327609, 327610, and 327611 for Subscription Edition, 2019, and 2016 respectively [E16].

### 8.3 Temporary and Compensating Controls

If immediate patching is delayed, implement emergency exposure reduction. These controls do **not** replace patching.

- Remove direct internet exposure where possible.
- Place SharePoint behind an authenticated Layer 7 reverse proxy or WAF capable of inspecting/filtering HTTP requests, as recommended by CISA [E7].
- Restrict access to `/_trust/default.aspx` to trusted identity provider or federation infrastructure where business architecture permits.
- Block external access to SharePoint Central Administration [E7].
- Restrict farm/database communications to required systems [E7].
- Enable or verify AMSI integration for each SharePoint web application and set Request Body Scan Mode to Full where feasible [E7][E12].
- Increase logging retention for IIS, ULS, Windows Event Logs, EDR, Defender, and WAF.

### 8.4 Machine Key and Credential Rotation

CISA recommends hunting for and remediating intrusion artifacts, including machine-key harvesters, **before rotating IIS machine keys**, to avoid immediately exposing replacement keys [E7]. Microsoft Learn documents machine-key rotation using Central Administration and PowerShell cmdlets such as `Set-SPMachineKey` and `Update-SPMachineKey` [E11].

Recommended order:

1. Preserve evidence and logs.
2. Patch all servers.
3. Hunt for web shells, malicious modules, unusual `w3wp.exe` behavior, and machine-key access.
4. Remove attacker artifacts and isolate compromised hosts if needed.
5. Rotate SharePoint/IIS machine keys farm-wide.
6. Rotate SharePoint service account passwords and other exposed credentials where compromise is suspected.
7. Restart/recycle services as required by Microsoft guidance and validate application health.
8. Continue monitoring for token anomalies and repeated access using old sessions.

### 8.5 Incident Response Recommendations

- Treat any internet-facing vulnerable SharePoint server exposed before patching as potentially compromised.
- Preserve IIS logs, ULS logs, WAF/proxy logs, Windows Security logs, Sysmon/EDR telemetry, Defender alerts, file system metadata, and relevant memory artifacts before cleanup.
- Review `w3wp.exe` child processes, outbound network connections, and unusual module loads.
- Review SharePoint paths and IIS virtual directories for new/modified `.aspx`, `.ashx`, `.asmx`, `.dll`, and `web.config` changes.
- Search for Defender/AMSI detections listed by CISA: `Exploit:Script/SuspSignoutReqBody.A`, `Exploit:Script/ToolPaneAuthBypass.A`, `Exploit:Script/ToolPaneAuthBypass.C`, and `Backdoor:MSIL/LeakFang.A!dha` [E7].
- Validate machine-key integrity and rotate after cleanup.
- Review SharePoint permissions, new admins, app registrations, farm solutions, timer jobs, scheduled tasks, services, and local administrators.
- If compromise is confirmed, perform broader identity and lateral movement investigation across Active Directory, SQL Server, file shares, and Microsoft 365 integrations.

---

## 9. Risk Assessment

| Dimension | Assessment | Evidence | Confidence |
|---|---|---|---:|
| Business impact | Critical for document repositories, intranets, workflows, and identity-integrated environments. RCE plus machine-key theft can expose sensitive data and enable persistence. | MSRC CVSS C/I/A:H; Bleeping/NHS machine-key theft [E1][E13][E14] | High |
| Likelihood | High for exposed vulnerable servers. | CISA KEV, public PoC reporting, EPSS 0.571010 [E4][E5][E13] | High |
| Exploit maturity | Public PoC reported; active exploitation confirmed by CISA KEV; private working exploit existed via ZDI/Pwn2Own path. | ZDI/CISA/Bleeping [E6][E4][E13] | High |
| Attack complexity | Low per Microsoft CVSS; ZDI CVSS used AC:H and mentions conjunction with other vulnerabilities. | MSRC/ZDI [E1][E6] | Medium-High |
| Internet exposure | Material but bounded; Censys estimated ~1,500 on-prem exposed hosts, while patch status may be hard to determine from headers. | Censys [E15] | Medium-High |
| Patch availability | Official fix available since 2026-07-14. | MSRC/KBase [E1][E8][E9][E10] | High |
| Active exploitation risk | High. | CISA KEV/NHS/Bleeping [E4][E14][E13] | High |
| Ransomware risk | Unknown specific usage; operational risk remains high due to RCE and persistence potential. | CISA KEV ransomware field Unknown [E4] | High |
| Severity | Critical | CVSS 9.8, KEV, active exploitation | High |
| Priority | P0 for internet-facing; P1 for internal-only broad-reach SharePoint | Derived from CVSS, KEV, exposure | High |
| Overall confidence | 9/10 | Multiple official and independent sources | High |

### Prioritization Guidance

- **P0 / emergency:** Any on-premises SharePoint 2016, 2019, or Subscription Edition server exposed to the internet, partner networks, or broad VPN access and below fixed build.
- **P1 / urgent:** Internal SharePoint servers below fixed build, especially those hosting sensitive documents or integrated with privileged identity workflows.
- **P2:** Patched servers requiring validation, key rotation, and post-exploitation review due to prior exposure.

---

## 10. Evidence Provenance Table

| ID | Evidence / finding supported | Source | Timestamp / date from source | Tool used | Confidence |
|---|---|---|---|---|---:|
| E1 | MSRC advisory: RCE, CWE-502, CVSS 9.8, affected products, fixed builds, original exploitability. | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522 | Released 2026-07-14; fetched 2026-07-27 | Web fetch | High |
| E2 | CVE.org record: description, CWE, CVSS, affected version ranges, updated date. | https://www.cve.org/CVERecord?id=CVE-2026-50522 | Updated 2026-07-27; fetched 2026-07-27 | Web fetch | High |
| E3 | NVD record: CVSS, CPEs, KEV table, change history, published/modified dates. | https://nvd.nist.gov/vuln/detail/CVE-2026-50522 | Published 2026-07-14; modified 2026-07-23; fetched 2026-07-27 | Web fetch | High |
| E4 | CISA KEV entry: active exploitation, due date, required action, ransomware unknown. | https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50522 | Date added 2026-07-22; fetched 2026-07-27 | Web fetch | High |
| E5 | FIRST EPSS: EPSS 0.571010, percentile 0.989740, date 2026-07-27. | https://api.first.org/data/v1/epss?cve=CVE-2026-50522 | 2026-07-27; fetched 2026-07-27 | Bash / HTTP request | High |
| E6 | ZDI-26-412: Pwn2Own origin, vulnerable `SessionSecurityTokenHandler`, no auth required, service account context, disclosure timeline. | https://www.zerodayinitiative.com/advisories/ZDI-26-412/ | Advisory 2026-07-15; fetched 2026-07-27 | Web fetch | High |
| E7 | CISA SharePoint hardening: active related SharePoint exploitation, AMSI detections, machine-key rotation sequencing, exposure reduction. | https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations | Last revised 2026-07-16; fetched 2026-07-27 | Web fetch | High |
| E8 | Microsoft Support KB5002882: Subscription Edition update, build and hash. | https://support.microsoft.com/help/5002882 | 2026-07-14; fetched 2026-07-27 | Web fetch | High |
| E9 | Microsoft Support KB5002883: SharePoint 2019 update, build and hash. | https://support.microsoft.com/help/5002883 | 2026-07-14; fetched 2026-07-27 | Web fetch | High |
| E10 | Microsoft Support KB5002891: SharePoint 2016 update, build and hash. | https://support.microsoft.com/help/5002891 | 2026-07-14; fetched 2026-07-27 | Web fetch | High |
| E11 | Microsoft Learn: machine-key rotation and `Set-SPMachineKey` / `Update-SPMachineKey`. | https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/improved-asp-net-view-state-security-key-management#automatic-machine-key-rotation | Last updated 2025-09-09; fetched 2026-07-27 | Web fetch | High |
| E12 | Microsoft Learn: AMSI integration with SharePoint and request body scanning. | https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/configure-amsi-integration | Fetched 2026-07-27 | Web fetch | High |
| E13 | BleepingComputer: active exploitation reports, watchTowr/Defused observations, public PoC details, machine-key theft. | https://www.bleepingcomputer.com/news/security/critical-sharepoint-rce-flaw-exploited-to-steal-machine-keys/ | Published 2026-07-21; fetched 2026-07-27 | Web fetch | Medium-High |
| E14 | NHS England alert: exploitation reported, public PoC, machine keys via single request, fixed builds, required rotation. | https://digital.nhs.uk/cyber-alerts/2026/cc-4818 | Published 2026-07-22 11:56; fetched 2026-07-27 | Web fetch | High |
| E15 | Censys exposure advisory: ~334k SharePoint web properties, ~1,500 on-prem hosts, header limitations. | https://censys.com/advisory/cve-2026-50522-cve-2026-58644/ | Published 2026-07-17; fetched 2026-07-27 | Web fetch | High |
| E16 | Tenable CVE/plugins: EPSS mirror, KEV, plugins 327609/327610/327611. | https://www.tenable.com/cve/CVE-2026-50522 and https://www.tenable.com/cve/CVE-2026-50522/plugins | Updated 2026-07-23; fetched 2026-07-27 | Web fetch | High |
| E17 | GitHub repository search results for CVE-2026-50522. | https://api.github.com/search/repositories?q=CVE-2026-50522&per_page=10 | Fetched 2026-07-27 | Bash / GitHub API | Medium |
| E18 | Exploit-DB public CSV search for CVE string. | https://gitlab.com/exploit-database/exploitdb/-/raw/main/files_exploits.csv | Fetched 2026-07-27 | Bash / CSV search | Medium-High |
| E19 | Rapid7 Metasploit repository issue/search query. | https://api.github.com/search/issues?q=repo%3Arapid7%2Fmetasploit-framework%20CVE-2026-50522&per_page=10 | Fetched 2026-07-27 | Bash / GitHub API | Medium |

---

## 11. Assumptions and Limitations

- No customer telemetry, logs, memory images, disk images, or incident artifacts were available.
- No exploit code was executed or validated.
- SharePoint source code and patch diff are not public; root-cause depth is limited to Microsoft and ZDI disclosures plus public reporting.
- Microsoft’s advisory contains a prerequisite inconsistency: the executive summary/CVSS indicate no privileges, while FAQ text mentions an authenticated Site Owner. Risk handling should assume no-auth exploitation due to CVSS PR:N, ZDI, CISA, NHS, and observed unauthenticated traffic reporting.
- Public PoC details are based on reporting; BleepingComputer explicitly states it did not test the PoC.
- No verified attacker IPs, domains, malware hashes, registry keys, or mutexes were found.
- Detection logic is starter content and must be tuned against local SharePoint authentication, federation, update, and administrative workflows.

---

## 12. Attack Path Diagram

```mermaid
flowchart TD
    A[Internet or network-reachable attacker] --> B[On-prem SharePoint vulnerable build]
    B --> C[POST to SharePoint sign-in/authentication surface]
    C --> D[Untrusted token data reaches unsafe deserialization]
    D --> E[Remote code execution in SharePoint/IIS service context]
    E --> F[Steal SharePoint/IIS machine keys]
    F --> G[Forge authentication tokens or cookies]
    G --> H[Impersonate users and access SharePoint content]
    H --> I[Persistence after patch if keys are not rotated]
    E --> J[Optional post-exploitation: web shell, tools, outbound C2]
    J --> K[Credential theft, lateral movement, data collection]
```

---

## 13. Analyst Action Checklist

### First 24 hours

- [ ] Inventory all SharePoint 2016, 2019, and Subscription Edition servers.
- [ ] Identify internet-facing and partner-accessible SharePoint endpoints.
- [ ] Patch all servers to fixed builds.
- [ ] Complete SharePoint configuration steps after patch installation.
- [ ] Preserve IIS, ULS, WAF, Windows, Defender, and EDR logs.
- [ ] Hunt `POST /_trust/default.aspx` with suspicious token/body indicators.
- [ ] Hunt `w3wp.exe` child processes and outbound connections.
- [ ] Hunt web shell/module/config changes in SharePoint/IIS paths.
- [ ] Review Microsoft Defender/AMSI detections from CISA guidance.
- [ ] Rotate machine keys only after patching and cleanup.

### 7-day hardening

- [ ] Enforce AMSI integration and Request Body Scan Full Mode where supported.
- [ ] Remove direct internet exposure or place SharePoint behind authenticated Layer 7 proxy/WAF.
- [ ] Block external Central Administration access.
- [ ] Review service accounts, local admins, farm admins, timer jobs, scheduled tasks, and farm solutions.
- [ ] Extend log retention and centralization.
- [ ] Add recurring machine-key rotation workflow.
- [ ] Plan migration away from unsupported SharePoint 2016/2019 where applicable.

---

## 14. References

1. Microsoft Security Update Guide — CVE-2026-50522: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522
2. CVE.org — CVE-2026-50522: https://www.cve.org/CVERecord?id=CVE-2026-50522
3. NVD — CVE-2026-50522: https://nvd.nist.gov/vuln/detail/CVE-2026-50522
4. CISA KEV — CVE-2026-50522: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50522
5. FIRST EPSS API: https://api.first.org/data/v1/epss?cve=CVE-2026-50522
6. ZDI-26-412: https://www.zerodayinitiative.com/advisories/ZDI-26-412/
7. CISA SharePoint Hardening Alert: https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations
8. Microsoft Support KB5002882: https://support.microsoft.com/help/5002882
9. Microsoft Support KB5002883: https://support.microsoft.com/help/5002883
10. Microsoft Support KB5002891: https://support.microsoft.com/help/5002891
11. Microsoft Learn — Improved ASP.NET view state security and key management: https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/improved-asp-net-view-state-security-key-management#automatic-machine-key-rotation
12. Microsoft Learn — Configure AMSI integration with SharePoint Server: https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/configure-amsi-integration
13. BleepingComputer — Critical SharePoint RCE flaw exploited to steal machine keys: https://www.bleepingcomputer.com/news/security/critical-sharepoint-rce-flaw-exploited-to-steal-machine-keys/
14. NHS England Digital — Critical Vulnerability CVE-2026-50522 in Microsoft SharePoint Server Under Exploitation: https://digital.nhs.uk/cyber-alerts/2026/cc-4818
15. Censys Advisory — Microsoft SharePoint Server RCE: https://censys.com/advisory/cve-2026-50522-cve-2026-58644/
16. Tenable — CVE-2026-50522: https://www.tenable.com/cve/CVE-2026-50522
17. Tenable plugins for CVE-2026-50522: https://www.tenable.com/cve/CVE-2026-50522/plugins
18. Exploit-DB public CSV: https://gitlab.com/exploit-database/exploitdb/-/raw/main/files_exploits.csv

---

## 15. Version History

| Version | Date | Author | Changes |
|---|---|---|---|
| 1.0 | 2026-07-27 | Pratik Chhetri | Initial enterprise CTI investigation report. |