CVE-2026-50522 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-50522 | CVSS 9.8 (Critical) | Exploit: PoC available

What Is It

CVE-2026-50522 is a critical deserialization vulnerability in Microsoft SharePoint Server that allows an unauthenticated, remote attacker to execute arbitrary code over a network.

Technical Detail

The flaw stems from improper handling of untrusted serialized data within SharePoint Server, a condition that allows an attacker to supply a maliciously crafted payload without requiring prior authentication. When SharePoint processes this input, the deserialization routine executes attacker-controlled code in the context of the server process, resulting in unauthenticated remote code execution (RCE). Successful exploitation grants the attacker the ability to run arbitrary commands on the underlying host, potentially leading to full server compromise, lateral movement, or data exfiltration depending on the server's role and network position.

Exploitation Status

A proof-of-concept (PoC) exploit is publicly available as of this writing. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning active in-the-wild exploitation has not been formally confirmed by CISA. However, the availability of a public PoC combined with the critical CVSS score of 9.8 and the unauthenticated attack vector significantly lowers the barrier for exploitation and increases the likelihood of active abuse in the near term.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been established for this CVE. Organizations should not interpret the absence of attribution as an indicator of low risk, particularly given the public PoC availability and the historically high targeting of SharePoint infrastructure by ransomware operators and state-sponsored actors.

What To Do

Apply the relevant Microsoft security update for SharePoint Server immediately, prioritizing internet-facing and internally accessible SharePoint deployments. Given the critical severity and public PoC availability, this should be treated as an emergency patching priority regardless of KEV status. If patching cannot be completed immediately, consider restricting network access to SharePoint Server from untrusted networks and enforcing perimeter controls to limit exposure. Detection efforts should focus on anomalous deserialization activity in SharePoint application logs, unexpected process spawning from SharePoint worker processes (w3wp.exe), and outbound network connections originating from the SharePoint host. Monitor Microsoft's Security Update Guide for any updated guidance or patch revisions.