SharePoint flaw exploited to steal machine keys

Hackers are actively exploiting CVE-2026-50522, a critical vulnerability in Microsoft SharePoint, to steal machine keys and preserve access even after affected servers are patched.

Microsoft classifies the issue as a deserialization-of-untrusted-data flaw that enables unauthenticated remote code execution over a network. The vulnerability was fixed in Microsoft’s July security updates. Although it was not listed as actively exploited, the advisory warned that exploitation was increasingly likely.

Offensive security firm watchTowr said attackers began targeting vulnerable on-premises SharePoint deployments shortly after a valid proof-of-concept exploit became public.

“On July 20th, watchTowr identified proof-of-concept exploit code for this vulnerability. Within hours, our global honeypot network, Attacker Eye, captured exploitation attempts using this PoC that successfully compromised target systems.”

The researchers said attackers are stealing machine keys, which can enable long-term access to compromised systems. Threat intelligence company Defused detected an “undocumented SharePoint deserialization vector” in attacks as early as July 17, but initially could not associate the activity with a specific vulnerability. The company said yesterday that the attacks were likely exploiting CVE-2026-50522.

Public exploit and recommended response

At least one PowerShell proof-of-concept exploit is available on GitHub from security researcher Janggggg. It attempts remote code execution by placing a malicious .NET BinaryFormatter payload in the cookie of a forged SecurityContextToken, delivered through a WS-Federation sign-in response to SharePoint’s /_trust/default.aspx endpoint.

Recommended reading

Suno breach exposed more than 55 million accounts

If the token reaches a vulnerable deserialization path, the payload can execute arbitrary code on the SharePoint server. BleepingComputer did not test the exploit, but reported that it appears structurally and technically legitimate. Janggggg published it on the same day watchTowr began detecting attacks, although it remains unclear whether the observed incidents used that publicly available code.

Applying the latest SharePoint security updates removes the vulnerability. watchTowr also recommends rotating credentials on any asset that may have been exposed.

×