“On July 20th, watchTowr identified proof-of-concept exploit code for this vulnerability,” the offensive security company wrote — and within hours its global honeypots captured live attempts that successfully compromised SharePoint servers.
CVE-2026-50522: what the flaw is and how Microsoft responded
Microsoft classified CVE-2026-50522 as a deserialization-of-untrusted-data vulnerability that allows a remote attacker to execute code over a network without authentication. The vulnerability was addressed in July's security updates from Microsoft. Microsoft did not mark the issue as actively exploited in its advisory, but the advisory warned of an increased likelihood that the flaw could be leveraged.
Public PoC, exploit mechanics, and the GitHub demonstrator
At least one PowerShell demonstrative exploit for CVE-2026-50522 was published on GitHub by security researcher Janggggg. The proof-of-concept attempts to trigger remote code execution by delivering a malicious .NET BinaryFormatter payload as the cookie of a forged SecurityContextToken inside a WS‑Federation sign-in response posted to SharePoint's /_trust/default.aspx endpoint. If that token is processed by a vulnerable deserialization path, the payload can result in arbitrary code execution on the SharePoint server. BleepingComputer did not test the PoC but reported that it looks structurally and technically legitimate.
watchTowr's detections and the theft of machine keys
watchTowr reported that, after the PoC appeared, its Attacker Eye honeypot network captured exploitation attempts that successfully compromised target systems. The company said attackers are stealing machine keys that allow them to maintain long-term access on breached servers — access that can persist even after the vulnerable SharePoint instance is patched.
Earlier signals from Defused and the timeline of exploitation
Early-warning threat intelligence company Defused detected what it called “an undocumented SharePoint deserialization vector” being used in attacks as early as July 17 but initially could not link the activity to a specific flaw. The company later said the attacks were likely driven by exploitation of CVE-2026-50522.
What this means for security teams, enterprise IT, and defenders
- Security teams and incident responders: watchTowr recommends applying Microsoft’s July SharePoint updates and rotating credentials on any asset that may have been exposed, because attackers have been observed stealing machine keys to preserve access after patching.
- Enterprise IT and administrators of on‑premise SharePoint deployments: administrators should prioritize installing the July security updates for SharePoint and review systems for indicators of compromise tied to deserialization exploitation paths — especially activity involving WS‑Federation sign‑in flows and unusual SecurityContextToken cookies.
- Detection and monitoring functions: the broader detection gap noted in related industry material is relevant here — a Picus whitepaper cited in the reporting shows that security teams log 54% of successful attacks and alert on just 14%, underscoring how many intrusions can move through environments unseen unless logs and alerts are tuned for this class of exploitation.
The record in this incident is specific: a high‑risk SharePoint deserialization vulnerability was fixed in July, a public PoC appeared on GitHub, and within hours at least one security firm’s honeypots recorded exploit attempts that led to compromise. The most concerning operational detail is the reported theft of machine keys, which enables attackers to retain access even after systems are patched. WatchTowr’s explicit advice — patch and rotate exposed credentials — is the practical, immediate step named by observers on the record.
Original reporting: https://www.bleepingcomputer.com/news/security/critical-sharepoint-rce-flaw-exploited-to-steal-machine-keys/
