A newly disclosed critical vulnerability, CVE-2026-50522 , affects on-premises Microsoft SharePoint servers and allows unauthenticated remote code execution (RCE) through the deserialization of untrusted data. The flaw impacts Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition (x64). By sending a specially crafted serialized object to a vulnerable SharePoint endpoint, an attacker can execute arbitrary code without requiring authentication or user interaction, making this one of the most severe SharePoint vulnerabilities disclosed in 2026.

Successful exploitation could result in a complete server compromise, enabling attackers to deploy web shells, steal sensitive application secrets, establish persistence, and use the compromised SharePoint server as a foothold for lateral movement across the enterprise network. The vulnerability was released alongside CVE-2026-58644, another SharePoint RCE flaw patched during Microsoft's July 2026 security updates. However, unlike CVE-2026-50522, CVE-2026-58644 requires an attacker to already possess Site Owner privileges before code execution is possible. Microsoft has confirmed active exploitation of CVE-2026-58644, while CVE-2026-50522 has not yet been officially confirmed as exploited, although its EPSS score of approximately 19.7% indicates a significant likelihood of exploitation in the near future.

Security researchers have observed suspicious attack activity that may already be targeting CVE-2026-50522. Defused researchers monitoring SharePoint honeypots identified undocumented .NET deserialization payloads directed at SharePoint sign-in endpoints without any authentication data, behavior that more closely matches the attack profile of CVE-2026-50522 than the authenticated CVE-2026-58644. Independent analysis from Reseacher further confirmed that both vulnerabilities were disclosed and patched together in Microsoft's July 2026 update, while identifying more than 10,000 internet-facing SharePoint servers that remain exposed, increasing the likelihood of widespread scanning and future exploitation attempts.

Organizations using on-premises SharePoint should prioritize immediate deployment of Microsoft's July 2026 cumulative security updates across every SharePoint server in their environment, as partially patched farms may still remain vulnerable. Affected versions include SharePoint Enterprise Server 2016 prior to 16.0.5561.1001, SharePoint Server 2019 prior to 16.0.10417.20175, and SharePoint Server Subscription Edition prior to 16.0.19725.20434. Defenders should also retire unsupported SharePoint deployments, monitor authentication and sign-in endpoints for suspicious unauthenticated deserialization requests, minimize internet exposure of SharePoint servers wherever possible, and continue tracking CISA's Known Exploited Vulnerabilities (KEV) Catalog, which already lists the related CVE-2026-58644 as actively exploited.