CVE-2026-50522

criticalknown exploitedpublic exploitCVSS 9.8covered by 12 sourcesfirst seen 2026-07-14

Actively exploited. CVE-2026-50522 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-07-22) — exploitation has been observed in the wild, and US federal agencies are required to remediate it under BOD 22-01. Treat patching as urgent.

Public exploit code is available. Proof-of-concept or working exploit code for CVE-2026-50522 is indexed in GitHub PoC. Expect opportunistic scanning and exploitation attempts — prioritize remediation.

JPCERT-AT-2026-0020 JPCERT/CC 2026-07-15(Initial) 2026-07-31(Update) I. Overview Microsoft has released July 2026 Security Updates to address the vulnerabilities in their products. Attackers leveraging these vulnerabilities may be able to execute arbitrary code remotely without authentication, etc. Microsoft Corporation July 2026 Security Updates https://msrc.microsoft.com/update-guide/en-US/releaseNote/2026-Jul According to Microsoft, among the vulnerabilities, the following vulnerabilities have been confirmed to be exploited in the wild. Please refer to the latest information provided by Microsoft and implement the measures described in "II. Solution." CVE-2026-56164 Microsoft SharePoint Server Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56164 CVE-2026-56155 Active Directory Federation Services Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56155 Update: July 31, 2026 Update Microsoft has updated its advisory and stated that the remote code execution vulnerability in SharePoint (CVE-2026-58644), which was addressed in this month's security updates, has been exploited in the wild. CVE-2026-58644 Microsoft SharePoint Remote Code Execution Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644 In addition, another remote code execution vulnerability (CVE-2026-50522)has been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog.Information believed to include a proof-of-concept (PoC) exploit for this vulnerability has been published by a security researcher. Furthermore,watchTowr has reported observing attacks using the PoC exploit against its honeypots and published information indicating that machine keys were stolen from vulnerable SharePoint Server. CVE-2026-50522 Microsoft SharePoint Remote Code Execution Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522

CSIRTS triage

What: Vulnerabilities allow attackers to execute arbitrary code remotely without authentication.
Who is affected: Deployments of Microsoft SharePoint Server and Active Directory Federation Services.
Urgency: Remediation is urgent as these vulnerabilities are confirmed to be exploited in the wild.
Action: Implement the July 2026 Security Updates provided by Microsoft.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-50522

Get an email if CVE-2026-50522 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Exploitation confirmedAlready exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 99% of all EPSS-scored CVEs.

Exploit availability

Public exploit or proof-of-concept code for CVE-2026-50522 is indexed in these free datasets. Available exploit code raises real-world risk independent of the CVSS score.

GitHub PoCPublic proof-of-concept repositories on GitHub reference this CVE.look it up ↗

Advisory coverage (12)

unknownexploitedSecurity Alert: [Updated] Microsoft Releases July 2026 Security Updatesjpcert · 2026-07-31
criticalexploitedMicrosoft security advisory – July 2026 monthly rollup (AV26-698) – Update 3cccs · 2026-07-23
criticalexploited2026-009: Critical Vulnerabilities in Microsoft SharePointcert-eu · 2026-07-23
highexploitedCISA Adds Two Known Exploited Vulnerabilities to Catalogcisa · 2026-07-22
criticalexploitedCVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerabilitycisa-kev · 2026-07-22
unknownexploitedMultiple vulnerabilities in Microsoft Sharepoint (July 22, 2026)cert-fr-alerte · 2026-07-22
unknownexploitedNCSC-2026-0237 [1.02] [H/H] Vulnerabilities Fixed in Microsoft Officencsc-nl · 2026-07-21
unknownexploitedNCSC-2026-0237 [1.01] [H/H] Vulnerabilities fixed in Microsoft Officencsc-nl · 2026-07-17
unknownMultiple vulnerabilities in Microsoft products (July 15, 2026)cert-fr-avis · 2026-07-15
unknownexploitedNCSC-2026-0237 [1.00] [M/H] Vulnerabilities fixed in Microsoft Officencsc-nl · 2026-07-14
criticalCVE-2026-50522: Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attack…nvd · 2026-07-14
criticalexploitedCVE-2026-50522: Microsoft SharePoint Remote Code Execution Vulnerabilitymsrc · 2026-07-14

External references

NVD record for CVE-2026-50522

CVE.org record

CISA KEV catalog

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-50522 status](https://www.csirts.com/badge/CVE-2026-50522)](https://www.csirts.com/cve/CVE-2026-50522)