SharePoint Critical RCE Vulnerabilities Under Active Exploitation

In July 2026, researchers and security agencies identified active exploitation of multiple critical vulnerabilities in on-premises Microsoft SharePoint Server, most notably CVE-2026-50522 and CVE-2026-58644. These flaws, which have CVSS scores of 9.8, allow attackers to execute arbitrary code by sending specially crafted requests that trigger unsafe deserialization of untrusted data.

Technically, the attacks involve manipulating the SessionSecurityTokenHandler class and other server-side request processing paths. Successful exploitation allows attackers to steal IIS or ASP.NET machine keys, which can be used to forge authentication tokens and maintain persistent access even after patches are applied. CISA has added several related SharePoint vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, signaling urgent risk to federal and private sectors.

The business impact is severe, potentially leading to full server compromise, data exfiltration from SharePoint databases, and lateral movement within the corporate network. Because machine key theft enables long-term persistence, organizations must not only patch affected systems but also rotate credentials and machine keys to ensure full remediation.