Critical SharePoint RCE Flaw (CVE-2026-50522) Exploited in the Wild to Exfiltrate IIS Machine Keys

Cybersecurity researchers and threat monitoring teams have detected active, widespread exploitation targeting on-premises Microsoft SharePoint deployments. Threat actors are leveraging a newly disclosed Remote Code Execution (RCE) vulnerability, tracked as CVE-2026-50522, to extract critical ASP.NET machine keys from compromised servers, allowing them to maintain persistent administrative access even after systems are patched.

Attack Chronology

The flaw was initially addressed by Microsoft as part of its Patch Tuesday release on July 14, 2026. While the original security advisory categorized the bug as a high-priority deserialization of untrusted data with an increased likelihood of exploitation, public proof-of-concept (PoC) code emerged on July 20, 2026.

Within hours of the PoC release, threat intelligence firm watchTowr and global honeypot networks observed automated scanning and active exploitation attempts against exposed SharePoint servers worldwide. Concurrently, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) catalog to mandate emergency updates across organization networks.

Technical Impact & Severity

The core vulnerability lies in improper handling during object deserialization within SharePoint’s internal processing pipeline. An unauthenticated remote attacker can issue specially crafted web requests to an exposed SharePoint instance, gaining arbitrary code execution under the privileges of the SharePoint web application service account.

The primary objective observed in current attacks is the exfiltration of IIS `ValidationKey` and `DecryptionKey` values from `web.config` configurations. Once attackers obtain these machine keys, they can:

• Independently forge valid ASP.NET authentication tokens and viewstate payloads.
• Impersonate high-privilege domain users or administrative accounts without triggering standard password verification.
• Maintain backdoor access to internal document repositories, confidential intranet files, and linked databases even after administrators install security patches.

Because machine keys remain identical unless manually regenerated, patching the binary files alone does not invalidate previously forged tokens or block attackers who already hold the secret keys.

Recommended Defense & Remediation Strategies

1. Apply Security Patches: Immediately install Microsoft's July 2026 security updates for on-premises SharePoint Server 2016, 2019, and Subscription Edition. 2. Rotate IIS Machine Keys: Generate new ASP.NET machine keys across all IIS web applications hosting SharePoint instances to revoke any compromised tokens. 3. Audit Web Server Logs: Inspect IIS and SharePoint ULS logs for anomalous POST requests pointing to deserialization endpoints or unexpected process creation under `w3wp.exe`. 4. Isolate exposed Portals: Ensure administrative SharePoint portals are strictly restricted behind zero-trust network access (ZTNA) or enterprise VPN solutions.