Microsoft Warns Critical SharePoint Flaw Is Under Active Attack

Another new vulnerability for Microsoft SharePoint, tracked as CVE-2026-50522, is now being actively exploited in the wild, Microsoft warns. Security team watchTowr found evidence of exploits in use, and noted that attacks started the same day, July 20th, as when a Proof of Concept (PoC) attack was published. Another security company, Defused, detected attacks as early as July 17th, which points to private versions of the attack developed in parallel rather than the published PoC version of the attack.

The eagle-eyed among you may notice that the vulnerability tracked as CVE-2026-50522 is one of the problems fixed in July's Patch Tuesday for Windows 11. At the time, no evidence of the vulnerability in use existed, but in the time since, attackers are using it as a vector against organizations that have yet to apply patches and secure SharePoint. Now that black hats are actively leveraging the vulnerability, applying the latest security patches should be a priority.


But what does the CVE-2026-50522 vulnerability actually do? It's quite concerning; essentially, it allows for full remote code execution (RCE) to be achieved on unsecured SharePoint servers. From there, any number of potential cyber attacks are possible, including installing malware on connected systems or stealing whatever data is stored on the SharePoint server, or the network it's connected to. Per watchTowr (via BleepingComputer) users are also advised to "rotate credentials on any asset that may have been exposed" after applying the new updates.

As we noted above, this isn't the only time that Microsoft SharePoint has been subjected to an RCE exploit, with a major attack documented almost exactly a year ago. In comparison, this version of the attack is far more simplified, since the older attack strung together numerous exploits to achieve RCE on SharePoint. CVE-2026-50522, meanwhile, is achieved with just a malicious .NET BinaryFormatter payload directly targeting SharePoint. Based on the older attack, SharePoint users may also want to consider enabling Antimalware Scan Interface and deploying Microsoft Defender for Endpoint protection after patching and updating credentials.