Exploitation of SharePoint deserialization flaw enables remote code execution and machine key theft

Summary

A critical vulnerability in Microsoft SharePoint Enterprise Server 2016, identified as CVE-2026-50522, is being actively exploited by attackers to achieve remote code execution (RCE). The flaw stems from the deserialization of untrusted data, allowing an unauthenticated attacker to execute arbitrary code over a network.

Security researchers at watchTowr observed exploitation attempts against on-premise SharePoint deployments shortly after a proof-of-concept exploit was made public. These attacks specifically target machine keys, which attackers use to create valid authentication tokens. By forging these identities, they can impersonate users and access sensitive sites or documents with the privileges of the compromised account.

Technical details

The vulnerability exists within how SharePoint processes specific data structures. An attacker can trigger remote code execution by delivering a malicious .NET BinaryFormatter payload. This payload is embedded as a cookie within a forged SecurityContextToken during a WS-Federation sign-in response.

The attack targets the /_trust/default.aspx endpoint. If the server processes this token through a vulnerable deserialization path, the payload executes on the SharePoint server.

While watchTowr detected exploitation following the release of a public proof-of-concept on July 20, threat intelligence firm Defused reported seeing an undocumented SharePoint deserialization vector as early as July 17. It is currently believed that these earlier activities were likely driven by this same CVE-2026-50522 vulnerability.

Proof of Concept

A PowerShell demonstrative exploit for CVE-2026-50522 has been published on GitHub by security researcher Janggggg. The exploit attempts to trigger RCE via the BinaryFormatter payload method described above.

Affected products and fixed versions

The following product is confirmed as vulnerable:

Microsoft addressed this vulnerability in the July security updates.

Why this matters for defenders

The primary danger of this exploit is not just the initial code execution, but the persistence it enables. By stealing machine keys, attackers can forge authentication tokens that remain valid even after the underlying vulnerability has been patched. This means a server could be fully updated and still be vulnerable to an attacker who has already extracted those keys.

Defender guidance

Immediate action is required for all organizations running on-premise Microsoft SharePoint deployments.

1. Patching: Apply the Microsoft security updates released in July to close the deserialization vulnerability.
2. Credential Rotation: Because attackers are targeting machine keys to maintain long-term access, patching alone may be insufficient if a breach has already occurred. You must rotate credentials on any asset that may have been exposed during the exploitation window.
3. Endpoint Monitoring: Monitor for unusual activity involving the /_trust/default.aspx endpoint and unexpected .NET BinaryFormatter payloads within authentication traffic.