Act nowKnown exploited

Advisory · CVE-2026-50522

SharePoint deserialization flaw gives unauthenticated remote code

Deserialization of untrusted data in SharePoint lets an unauthorized attacker execute code over the network with no authentication, rated CVSS 9.8.

Advisory published July 22, 2026Independent summary
Vendor
Microsoft
Product
SharePoint
Identifier / CWE
CVE-2026-50522
CWE-502
Action timing
Aug 12, 2026
ELI5

Explain it like I’m five

SharePoint accepts a sealed package and opens it without checking the sender. Inside is a jack-in-the-box that runs the attacker's instructions.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted payload

    An unauthorized attacker sends a request containing a malicious serialized object to the SharePoint server.

  2. 02Unsafe deserialization

    SharePoint deserializes the untrusted data without adequate validation.

  3. 03Code execution

    Deserialization triggers the attacker's code, running in the SharePoint server context.

  4. 04Network reachable

    The attack works over the network with no authentication and no user interaction.

What happened

CISA added CVE-2026-50522 to the Known Exploited Vulnerabilities catalog on July 22, 2026. Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. No authentication and no user interaction are required, and the flaw is scored CVSS 9.8.

NVD data lists SharePoint Server Subscription Edition, SharePoint Server 2016, and SharePoint Server 2019 as affected. Deserialization flaws in SharePoint have a grim history: they are trivially weaponized once public, and internet-facing SharePoint servers are routinely the first systems compromised in an intrusion.

What to do

  1. Apply Microsoft’s July 2026 security updates for SharePoint to all affected servers, prioritizing internet-facing ones.
  2. Hunt for web shells and other persistence in SharePoint virtual directories, the layouts folder, and application pools.
  3. Review IIS and SharePoint ULS logs for anomalous requests, particularly ones carrying serialized payloads, in the window before patching.
  4. If compromise is suspected, isolate the server and engage incident response; SharePoint servers typically have broad access to content databases and service accounts.
  5. Reduce exposure by restricting SharePoint web applications to trusted networks where business needs allow.

Management note

Unauthenticated remote code execution on a collaboration platform is about as bad as it gets: SharePoint holds documents, credentials in service accounts, and a trusted position inside the network. This class of flaw has repeatedly been the initial access vector for ransomware operations. Patching is urgent, but the investigation matters just as much, because these servers are usually compromised silently and early.