CVE-2026-50522
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Description
CVE-2026-50522 is a deserialization of untrusted data vulnerability in Microsoft Office SharePoint that allows an unauthorized attacker to execute code over a network. Rated CVSS 9.8 (Critical), the flaw needs no credentials and no user interaction: a crafted serialized payload sent to a vulnerable SharePoint Server is reconstructed into objects that trigger code execution in the context of the application. Microsoft SharePoint Server 2016, 2019, and builds prior to 16.0.19725.20434 are affected, which covers on-premises farms that frequently hold an organisation's most sensitive documents. The EPSS score of 63% places CVE-2026-50522 in the 99th percentile for exploitation likelihood, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog with a remediation due date of 2026-07-25, so this SharePoint vulnerability is both actively exploited and highly likely to be attacked again.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | sharepoint server | < 16.0.19725.20434; 2016; 2019 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50522(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
Deserialization of Untrusted Data occurs when an application reconstructs objects from serialized data supplied by an untrusted source without sufficiently verifying that the result will be valid and safe. In Microsoft SharePoint the vulnerable code path accepts attacker-controlled serialized input over the network, and during reconstruction the attacker can cause arbitrary types to be instantiated and dangerous operations to run, which in a .NET application turns a data-parsing step into remote code execution on the server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2026-50522 carries a CVSS 3.1 base score of 9.8 (Critical) with every exploitability metric at its worst: remotely exploitable without physical access, easy to exploit with no special conditions needed, no authentication needed, and no user action required. Confidentiality (High): code execution on a SharePoint server exposes the document libraries, site content, service account credentials, and configuration data stored in the farm. Integrity (High): the attacker can alter or plant content and code, which makes a trusted collaboration platform a delivery channel for the next stage of an intrusion. Availability (High): the same access permits disruption or shutdown of the SharePoint service that internal business processes depend on. The EPSS score of 63% (99.1st percentile) indicates a high likelihood of active exploitation, and the CISA KEV listing confirms it is already happening. Because SharePoint servers are often reachable from the internet for external collaboration and hold data from across a business, an unpatched farm represents both an immediate breach risk and a strong pivot point into the wider Windows environment.
Exploit Maturity
CVE-2026-50522 is listed in CISA's Known Exploited Vulnerabilities catalog, which confirms active exploitation in the wild, with a remediation deadline of 2026-07-25; ransomware use is currently marked as Unknown. No public exploit code is linked in the available references — the published sources are the Microsoft advisory and the CISA KEV entry — but the EPSS score of 63% (99.1st percentile) means exploitation activity is expected to continue and broaden, a far stronger signal than most KEV entries carry. Unauthenticated deserialization flaws in SharePoint have a track record of rapid weaponisation and reuse across intrusion sets once the vulnerable endpoint is public knowledge, so the practical answer to "do I need to act now" is yes: patch to build 16.0.19725.20434 or later and check the farm for signs of prior compromise rather than assuming the patch closes an already-used door.
Remediation
- Follow the CISA KEV required action: apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 risk-based patching guidance and CISA's Forensics Triage Requirements, and discontinue use of the product if mitigations are unavailable. The KEV due date is 2026-07-25.
- Install the Microsoft security update referenced in the MSRC advisory for CVE-2026-50522. Bring SharePoint Server to build 16.0.19725.20434 or later, and apply the corresponding updates for SharePoint Server 2016 and SharePoint Server 2019; verify the build number after patching rather than relying on the update history.
- Reduce exposure until every farm server is patched: remove direct internet publication of SharePoint web applications, require access through a VPN or an authenticating reverse proxy, and segment the SharePoint tier from untrusted network segments and from unrelated internal systems.
- Perform forensic triage on all SharePoint servers as CISA requires: review IIS logs and SharePoint ULS logs for anomalous POST requests to service endpoints, look for unexpected child processes of the application pool identity, and search the web directories for newly created files or web shells, since exploitation is confirmed in the wild.
- As long-term hardening against deserialization flaws (CWE-502), avoid exposing endpoints that deserialize untrusted input, prefer text-based formats such as JSON over binary serialization for data interchange, enforce integrity checks such as HMAC or digital signatures on serialized data, and restrict deserialization to an allowlist of expected types.
Technical Details
The root cause of CVE-2026-50522 is unsafe deserialization in Microsoft Office SharePoint (CWE-502): the application reconstructs objects from serialized data that an attacker can supply over the network without adequately validating that the resulting object graph is safe to materialise. Attackers who control serialized data can manipulate it to instantiate arbitrary objects, set malicious property values, or trigger dangerous operations during deserialization, and in .NET-based products these gadget chains typically culminate in arbitrary code execution under the identity of the application pool. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H explains the 9.8 score: the payload arrives over the network (AV:N), requires no special conditions (AC:L), no privileges (PR:N), and no user interaction (UI:N), while confidentiality, integrity, and availability of the SharePoint server are all fully impacted. The scope remains unchanged (S:U), so CVSS attributes the damage to the vulnerable component itself, but a SharePoint server authenticated into Active Directory with a service account gives an attacker a natural route towards lateral movement.
Frequently Asked Questions
Is CVE-2026-50522 being actively exploited?
Yes. CVE-2026-50522 is listed in CISA's Known Exploited Vulnerabilities catalog, which confirms exploitation in the wild, with a federal remediation deadline of 2026-07-25. Its EPSS score of 63% ranks it in the 99th percentile for exploitation likelihood, indicating that further attacks are highly probable; ransomware usage is currently marked as Unknown.
What products are affected by CVE-2026-50522?
The vulnerability affects Microsoft SharePoint Server, specifically SharePoint Server 2016, SharePoint Server 2019, and builds prior to version 16.0.19725.20434. Any on-premises SharePoint farm should be checked against its build number, as the flaw is in the product's deserialization handling rather than in a specific optional feature.
How do I fix CVE-2026-50522?
Install the Microsoft security update from the MSRC update guide for CVE-2026-50522 and bring SharePoint Server to build 16.0.19725.20434 or later, or the corresponding patched build for SharePoint Server 2016 and 2019. Until every farm server is updated, restrict internet access to SharePoint web applications and review IIS and ULS logs for signs of exploitation.
How severe is CVE-2026-50522?
CVE-2026-50522 is rated Critical with a CVSS 3.1 base score of 9.8. It permits unauthenticated remote code execution with high impact on confidentiality, integrity, and availability, and the combination of a 99th-percentile EPSS score with the CISA KEV listing means the vulnerability is not a theoretical risk but an actively exploited one.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.