SharePoint flaw now used to steal machine keys

Attackers are now actively exploiting CVE-2026-50522, a critical Microsoft SharePoint bug, to steal machine keys and preserve access even after vulnerable servers are patched.

Microsoft describes the issue as a deserialization of untrusted data flaw that lets a remote attacker execute code over the network without authentication. The company fixed it in July’s security updates, and while the advisory did not mark it as actively exploited at the time, it did warn of an increased likelihood of exploitation.

Security firm watchTowr said attackers began targeting vulnerable on-premises SharePoint deployments almost immediately after a working proof-of-concept exploit became public.

“On July 20th, watchTowr identified proof-of-concept exploit code for this vulnerability. Within hours, our global honeypot network, Attacker Eye, captured exploitation attempts using this PoC that successfully compromised target systems.”

According to the researchers, the attackers are specifically stealing machine keys to maintain long-term access on compromised systems. Threat intelligence company Defused had already spotted what it called “an undocumented SharePoint deserialization vector” in attacks as early as July 17, though it could not tie the activity to a specific flaw at the time. The company said yesterday that those attacks were likely exploiting CVE-2026-50522.

Public PoC exploit details

At least one PowerShell demonstration exploit for CVE-2026-50522 is now available on GitHub from security researcher Janggggg. The exploit attempts to trigger remote code execution by sending a malicious .NET BinaryFormatter payload in the cookie of a forged SecurityContextToken inside a WS-Federation sign-in response posted to SharePoint’s /_trust/default.aspx endpoint.

Recommended reading

UK tests show top AI models still cheat

If a vulnerable deserialization path processes that token, the payload can lead to arbitrary code execution on the SharePoint server. BleepingComputer said it did not test the exploit, but that it appears structurally and technically legitimate.

The PoC was published on the same day watchTowr began seeing attacks using exploit code, although it remains unclear whether the observed incidents relied on the public version. watchTowr said patching removes the vulnerability, but defenders should also rotate credentials on any asset that may have been exposed.

×