Deserialization Vulnerability in Microsoft SharePoint by Microsoft
CVE-2026-50522

9.8CRITICAL

Key Information:

Vendor: Microsoft
Status: Microsoft Sharepoint Enterprise Server 2016; Microsoft Sharepoint Server 2019; Microsoft Sharepoint Server Subscription Edition
Vendor: CVE Published:; 14 July 2026

Badges

📈 Trended📈 Score: 5,920💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 76%🦅 CISA Reported📰 News Worthy

What is CVE-2026-50522?

CVE-2026-50522 is a security vulnerability identified in Microsoft SharePoint, a platform widely utilized for collaboration, document management, and sharing within organizations. This vulnerability arises from the deserialization of untrusted data, which can potentially allow unauthorized attackers to execute arbitrary code over a network. If exploited, this issue could enable attackers to gain access to sensitive information or control corporate resources, posing serious risks to organizational integrity and confidentiality. Given SharePoint's central role in managing critical business documents and workflows, the implications of this vulnerability could be particularly detrimental to organizations relying on its services.

Potential impact of CVE-2026-50522

Unauthorized Code Execution: The primary impact of this vulnerability is the ability for attackers to execute malicious code remotely. This could allow them to manipulate data, install malware, or even pivot to other systems within the organization’s network, significantly increasing the risk of a broader compromise.
Data Breach Risks: Exploitation of this vulnerability could lead to unauthorized access to sensitive or proprietary data stored within SharePoint. This poses a substantial risk for data breaches, which can have severe legal, financial, and reputational repercussions for an organization.
Operational Disruption: Successful exploitation could disrupt normal business operations by causing system outages or failures. This might hinder the collaborative workflows that SharePoint facilitates, potentially resulting in loss of productivity and increased recovery costs.

CISA has reported CVE-2026-50522

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-50522 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

Microsoft SharePoint Enterprise Server 2016 x64-based Systems 16.0.0 < 16.0.5561.1001

Microsoft SharePoint Server 2019 x64-based Systems 16.0.0 < 16.0.10417.20175

Microsoft SharePoint Server Subscription Edition x64-based Systems 16.0.0 < 16.0.19725.20434

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-50522
Created by darses

CVE-2026-50522
Created by 4minx

CVE-2026-50522
Created by HORKimhab

News Articles

Notebookcheck

CVE-2026-56164 CVE-2026-50522

SharePoint zero-day grants Farm Admin rights, CISA warns

CISA warns of active exploitation targeting on-premises SharePoint Server, with attackers stealing IIS machine keys to survive patching. See which CVEs are confirmed exploited and how to respond.

2 weeks ago