# 🛡️ CVE-2026-50522 — Microsoft SharePoint RCE Investigation
### Critical SharePoint Deserialization Vulnerability Under Active Exploitation
**Created by Pratik Chhetri**
**Report Date:** 2026-07-27
---
## 📌 Executive Snapshot
| Field | Finding |
|---|---|
| **Vulnerability** | CVE-2026-50522 |
| **Product** | Microsoft SharePoint Server on-premises |
| **Affected versions** | SharePoint Server 2016, SharePoint Server 2019, SharePoint Server Subscription Edition before fixed builds |
| **Weakness** | CWE-502 — Deserialization of Untrusted Data |
| **Impact** | Remote Code Execution |
| **CVSS v3.1** | 9.8 Critical — `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |
| **EPSS** | 0.571010 / 98.974 percentile as of 2026-07-27 |
| **CISA KEV** | Added 2026-07-22; due 2026-07-25 |
| **Ransomware usage** | Unknown per CISA KEV |
| **Public PoC** | Reported available; GitHub repositories observed |
| **Active exploitation** | Confirmed by CISA KEV and public-sector/security reporting |
| **Primary risk** | RCE plus SharePoint/IIS machine-key theft enabling token forgery and persistence |
---
## 🚨 Key Takeaways
> CVE-2026-50522 is not a routine patching item. It is a **Critical RCE** with public exploit reporting, KEV status, and observed machine-key theft.
- Attackers have reportedly abused the flaw to obtain SharePoint machine keys.
- Stolen machine keys can allow forged authentication tokens and access that may survive patching.
- Patching closes the vulnerability, but exposed servers still require hunting and key rotation.
- Internet-facing on-premises SharePoint servers should be handled as emergency risk.
---
## 🧭 Attack Path
```mermaid
flowchart TD
A[Remote attacker] --> B[Reachable on-prem SharePoint]
B --> C[Crafted request to sign-in/auth surface]
C --> D[Unsafe deserialization]
D --> E[Remote code execution]
E --> F[Machine-key theft]
F --> G[Forge auth tokens/cookies]
G --> H[Impersonate users]
H --> I[Access SharePoint sites and documents]
F --> J[Persistence after patch if keys not rotated]
```
---
## 🧩 Affected Versions and Fixes
| Product | Vulnerable before | Required fixed build | Patch |
|---|---:|---:|---|
| SharePoint Server 2016 / Enterprise Server 2016 | `16.0.5561.1001` | `16.0.5561.1001` or later | KB5002891 |
| SharePoint Server 2019 | `16.0.10417.20175` | `16.0.10417.20175` or later | KB5002883 |
| SharePoint Server Subscription Edition | `16.0.19725.20434` | `16.0.19725.20434` or later | KB5002882 |
---
## 🧠 Root Cause Summary
ZDI identifies the affected area as the **`SessionSecurityTokenHandler`** class. The flaw is caused by insufficient validation of user-supplied data, enabling unsafe deserialization and remote code execution in affected SharePoint installations.
Public reporting describes a PoC path involving SharePoint sign-in processing and `/_trust/default.aspx`. Exact implementation details are limited because SharePoint source and patch diff are not public.
---
## 🔥 Threat Intelligence Summary
| Item | Status | Confidence |
|---|---|---:|
| Active exploitation | Confirmed by CISA KEV | High |
| Public PoC | Reported; GitHub repositories found | Medium |
| Exploit-DB entry | Not Found | Medium-High |
| Metasploit module | Not Found | Medium |
| Named threat actor | Not Found | Medium |
| Ransomware campaign | Unknown per CISA | High |
| Machine-key theft | Reported by multiple sources | High |
---
## 🕒 Investigation Timeline
```mermaid
timeline
title CVE-2026-50522 Timeline
2026-05-21 : Reported to vendor via ZDI/Pwn2Own path
2026-07-14 : Microsoft advisory and patches released
2026-07-15 : ZDI advisory published
2026-07-17 : Exposure advisory and early exploitation reporting window
2026-07-20 : Public PoC reportedly appears; exploitation observed within hours
2026-07-22 : CISA adds CVE-2026-50522 to KEV
2026-07-25 : CISA remediation due date
2026-07-27 : Report finalized
```
---
## 🛠️ Defender Action Plan
### Immediate — First 24 Hours
- [ ] Inventory all on-premises SharePoint servers.
- [ ] Prioritize internet-facing and partner-accessible farms.
- [ ] Apply Microsoft July 2026 SharePoint updates.
- [ ] Verify fixed builds across every farm member.
- [ ] Preserve IIS, ULS, WAF, Defender, Windows, and EDR logs.
- [ ] Hunt for suspicious `POST /_trust/default.aspx` activity.
- [ ] Hunt for `w3wp.exe` spawning command-line tools.
- [ ] Hunt for new/modified `.aspx`, `.ashx`, `.asmx`, `.dll`, and `web.config` files.
- [ ] Review Microsoft Defender/AMSI detections.
- [ ] Rotate machine keys after cleanup.
### Hardening — Next 7 Days
- [ ] Enable/verify AMSI integration for every SharePoint web application.
- [ ] Use Request Body Scan Full Mode where feasible.
- [ ] Remove direct internet exposure.
- [ ] Place SharePoint behind authenticated Layer 7 reverse proxy/WAF.
- [ ] Block external Central Administration access.
- [ ] Restrict farm/database communications.
- [ ] Review service accounts, farm admins, timer jobs, scheduled tasks, and farm solutions.
- [ ] Plan migration away from unsupported SharePoint 2016/2019 where applicable.
---
## 🔎 High-Value Detection Ideas
### Web / IIS / WAF
```text
POST /_trust/default.aspx
AND request contains any of:
SecurityContextToken
BinaryFormatter
AAEAAAD
```
### Endpoint / EDR
```text
Parent process: w3wp.exe
Child process: cmd.exe, powershell.exe, pwsh.exe, certutil.exe, bitsadmin.exe,
mshta.exe, rundll32.exe, regsvr32.exe, cscript.exe, wscript.exe
```
### File Integrity
```text
Monitor:
C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\
C:\inetpub\wwwroot\wss\VirtualDirectories\
Alert on new or modified:
*.aspx, *.ashx, *.asmx, *.dll, web.config
```
### Microsoft Defender / AMSI Detections From CISA Guidance
```text
Exploit:Script/SuspSignoutReqBody.A
Exploit:Script/ToolPaneAuthBypass.A
Exploit:Script/ToolPaneAuthBypass.C
Backdoor:MSIL/LeakFang.A!dha
```
---
## 📊 Risk Matrix
| Exposure | Likelihood | Impact | Priority |
|---|---:|---:|---:|
| Internet-facing vulnerable SharePoint | High | Critical | P0 |
| Partner/VPN-accessible vulnerable SharePoint | High | Critical | P0/P1 |
| Internal-only vulnerable SharePoint with broad access | Medium-High | High | P1 |
| Patched but exposed before remediation | Medium | High | P1 — hunt and rotate |
| Patched, hunted, keys rotated, hardened | Low-Medium | Medium | Monitor |
---
## ✅ Verified Indicators and Gaps
| Category | Result |
|---|---|
| Attacker IPs | Not Found |
| Attacker domains | Not Found |
| Full malicious URLs | Not Found |
| Malicious file hashes | Not Found |
| Registry keys | Not Found |
| Mutexes | Not Found |
| Verified network path | `/_trust/default.aspx` |
| Verified detection names | Microsoft Defender/AMSI names listed above |
| Verified sensitive target | SharePoint/IIS machine keys |
---
## 📚 Full Report
The detailed analyst report is available in this repository:
➡️ **[`CVE-2026-50522_CTI_Report.md`](./CVE-2026-50522_CTI_Report.md)**
It includes:
- Official CVE details
- CPE validation
- Root-cause analysis
- Exploit maturity assessment
- Threat intelligence findings
- IOC table
- MITRE ATT&CK mapping
- Sigma ideas
- Wazuh guidance
- Splunk SPL
- Microsoft Sentinel KQL
- Snort/Suricata signatures
- Risk assessment
- Mitigation playbook
- Evidence provenance table
- Assumptions and limitations
---
## 🔗 Primary References
- Microsoft Security Update Guide: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522
- CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-50522
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50522
- CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50522
- ZDI-26-412: https://www.zerodayinitiative.com/advisories/ZDI-26-412/
- NHS England Alert: https://digital.nhs.uk/cyber-alerts/2026/cc-4818
- BleepingComputer: https://www.bleepingcomputer.com/news/security/critical-sharepoint-rce-flaw-exploited-to-steal-machine-keys/
- Censys Advisory: https://censys.com/advisory/cve-2026-50522-cve-2026-58644/
---
**Patch. Hunt. Rotate keys. Harden exposure.**