2026-009: Critical Vulnerabilities in Microsoft SharePoint
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
[UPDATED] On 14 July 2026, Microsoft released security updates addressing critical remote code execution (RCE) vulnerabilities in Microsoft SharePoint Server. On 20 July 2026, WatchTowr identified a proof-of-concept exploit code and subsequently observed active exploitation of CVE-2026-50522, a vulnerability part of an ongoing series of actively exploited flaws affecting on-premise SharePoint Server instances, including CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644. CERT-EU strongly recommends updating affected servers immediately, rotating credentials for any assets that may have been exposed to the internet, and conducting a compromise assessment.
CSIRTS triage
- What
- A critical Remote Code Execution vulnerability has been identified in Microsoft SharePoint Server.
- Who is affected
- Deployments of Microsoft SharePoint Server are affected, especially those exposed on the internet.
- Urgency
- Remediation is urgent due to the availability of proof-of-concept exploit code and successful exploitation attempts.
- Action
- Update affected servers and rotate credentials for potentially exposed assets.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch SharePoint Server
Get an email when a new SharePoint Server advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://cert.europa.eu/publications/security-advisories/2026-009/
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-50522Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 99% of all scored CVEs.
- Exploitation confirmedCVE-2026-32201Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 97% of all scored CVEs.
- Exploitation confirmedCVE-2026-45659Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 95% of all scored CVEs.
- Exploitation confirmedCVE-2026-56164Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 97% of all scored CVEs.
- Exploitation confirmedCVE-2026-58644Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 93% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-50522 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-32201 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-45659 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-56164 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-58644 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownexploitedSecurity Alert: [Updated] Microsoft Releases July 2026 Security Updatesjpcert
- criticalexploitedMicrosoft security advisory – July 2026 monthly rollup (AV26-698) – Update 3cccs
- highexploitedCISA Adds Two Known Exploited Vulnerabilities to Catalogcisa
- criticalexploitedCVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerabilitycisa-kev
- unknownexploitedMultiple vulnerabilities in Microsoft Sharepoint (July 22, 2026)cert-fr-alerte
- unknownexploitedNCSC-2026-0237 [1.02] [H/H] Vulnerabilities Fixed in Microsoft Officencsc-nl
- unknownexploitedNCSC-2026-0237 [1.01] [H/H] Vulnerabilities fixed in Microsoft Officencsc-nl
- highexploitedCISA Adds Three Known Exploited Vulnerabilities to Catalogcisa
- criticalexploitedCVE-2026-58644: Microsoft SharePoint Deserialization of Untrusted Data Vulnerabilitycisa-kev
- criticalexploitedAL26-017 - Critical vulnerabilities impacting Microsoft SharePoint Server – CVE-2026-56164, CVE-2026-55040 and…cccs
- unknownMicrosoft Monthly Security Update (July 2026)hkcert
- unknownMultiple vulnerabilities in Microsoft products (July 15, 2026)cert-fr-avis
More from CERT-EU Security Advisories
- critical2026-008: Critical vulnerabilities in Ivanti Sentry2026-06-10
- critical2026-007: Critical Vulnerability in Windows Netlogon2026-06-10
- critical2026-006: Critical Vulnerability in PAN-OS2026-05-06
- high2026-005: High Vulnerability in the Linux Kernel ("Copy Fail")2026-04-30
- critical2026-004: Critical Vulnerability in SharePoint Exploited2026-03-25