CVE-2026-50522: Microsoft Sharepoint Server

What is CVE-2026-50522?

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

CVSS9.8 NVD 3.1

SeverityCRITICAL

Exploitation In the wild

EPSS20% · P97

Triage statusActive Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWECWE-502

NVD published2026-07-14

NVD last modified2026-07-15

Timeline

2026-07-14Published to the U.S. National Vulnerability Database (NVD)
2026-07-15NVD record last updated
2026-07-22First covered in a defend.network daily briefing

Affected product

Microsoft Sharepoint Server

Remediation Steps

Apply the latest Microsoft SharePoint security update from July 2026 Patch Tuesday
Verify patch deployment across all affected SharePoint Server instances
Audit server logs for evidence of exploitation and unauthorized access
Review and rotate machine keys on affected systems to prevent persistence
Implement network segmentation to restrict SharePoint access where feasible

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 3 of July 2026 (July 20 – 26)
SharePoint RCE, WordPress flaws, PAN-OS actively exploited in ransomware campaigns (2026-07-22)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.