Vulnerability Analysis

CVE-2026-50522: Critical SharePoint RCE Exploited in the Wild — What It Is & How to Fix It

Executive Summary

CVE-2026-50522 is a critical (CVSS 9.8) unauthenticated remote code execution vulnerability in on-premises Microsoft SharePoint Server stemming from insecure deserialization in the Windows Identity Foundation SessionSecurityTokenHandler class. A public proof-of-concept was released on July 20, 2026, triggering active exploitation within hours — attackers are compromising servers, stealing machine keys, and establishing persistent footholds that survive patching. CISA added this CVE to its Known Exploited Vulnerabilities catalog on July 22, 2026 with a federal remediation deadline of July 25. Organizations running on-premises SharePoint must patch immediately and rotate machine keys.

1. What Is This Vulnerability?

CVE-2026-50522 is a deserialization of untrusted data flaw (CWE-502) in Microsoft SharePoint Server's WS-Federation token processing pipeline. Specifically, the vulnerability exists in the SessionSecurityTokenHandler class — part of the Windows Identity Foundation (WIF) framework that .NET applications use to read, serialize, and deserialize SessionSecurityToken objects.

SharePoint's /_trust/default.aspx endpoint accepts WS-Federation sign-in responses containing serialized security tokens. Microsoft failed to validate the deserialized payload before passing it to the .NET BinaryFormatter, which — when given attacker-controlled data — allows arbitrary code execution at the permission level of the SharePoint application pool.

The Root Cause

// VULNERABLE: No validation before deserialization
public SessionSecurityToken ReadToken(XmlReader reader, SecurityTokenResolver tokenResolver)
{
    // Reads attacker-controlled cookie value
    byte[] cookieData = ReadCookieValue(reader);
    
    // BinaryFormatter deserializes without type validation — DANGEROUS
    using (var ms = new MemoryStream(cookieData))
    {
        var formatter = new BinaryFormatter();
        return (SessionSecurityToken)formatter.Deserialize(ms); // ← RCE here
    }
}

The BinaryFormatter is notoriously unsafe for untrusted input because it executes type constructors and property setters during deserialization, enabling gadget-chain attacks.

Attack Vector

The publicly available PowerShell PoC (authored by researcher "Janggggg") delivers a malicious .NET BinaryFormatter gadget chain payload as the cookie of a forged SecurityContextToken, wrapped in a WS-Federation sign-in response and HTTP POST'd to /_trust/default.aspx. No credentials, no authentication, no user interaction required.

Attack flow:

  1. Attacker crafts a malicious serialized payload using a known .NET gadget chain (e.g., TypeConfuseDelegate, ObjectDataProvider)
  2. Payload is base64-encoded and embedded in a forged WS-Federation assertion as a SecurityContextToken cookie
  3. HTTP POST to https://target-sharepoint/_trust/default.aspx with the crafted payload
  4. SharePoint deserializes the token cookie, triggering arbitrary code execution as the IIS application pool account (typically NETWORK SERVICE or a managed service account)
  5. Attacker uses initial foothold to extract IIS machine keys from the web.config
  6. Stolen machine keys enable indefinite forged token creation — access persists even after patching

Real-World Impact

Active exploitation was confirmed by WatchTowr's global honeypot network on July 20, 2026 — within hours of the PoC going public. Observed attacker behavior includes:

  • Extracting SharePoint machine keys (validationKey and decryptionKey) via a single request
  • Deploying web shells (.aspx) to maintain persistent access
  • Forging authentication tokens to impersonate SharePoint users and exfiltrate documents
  • Using compromised SharePoint servers as pivot points for lateral movement into connected Active Directory and Microsoft 365 environments
  • CVE-2026-50522 represents the fourth SharePoint vulnerability exploited in July 2026 alone, following CVE-2026-56164 and CVE-2026-58644

2. Who Is Affected?

This vulnerability only affects on-premises SharePoint Server installations. SharePoint Online (Microsoft 365) is not affected.

Product Affected Versions
Microsoft SharePoint Enterprise Server 2016 (all CUs before July 2026 patch)
Microsoft SharePoint Server 2019 (all CUs before July 2026 patch)
Microsoft SharePoint Server Subscription Edition (before July 2026 patch)

Highest risk configurations:

  • SharePoint servers with the /_trust/default.aspx endpoint accessible from the internet (common in hybrid AD FS deployments)
  • Organizations using WS-Federation or SAML-based claims authentication
  • SharePoint farms without network perimeter controls isolating the /_trust/ endpoint
  • Any system where machine keys have not been rotated after July 14, 2026

Not affected:

  • SharePoint Online / Microsoft 365
  • SharePoint Foundation (no WS-Federation endpoint)
  • Systems fully patched with the July 2026 Cumulative Update and machine keys rotated

3. How to Detect It (Testing)

Manual Testing Steps

Step 1 — Verify exposure of the /_trust endpoint:

# Check if the WS-Federation endpoint is accessible
curl -v "https://your-sharepoint-server/_trust/default.aspx" \
  --max-time 10 --output /dev/null

# A 400/405 response (not 404/connection refused) indicates the endpoint exists

Step 2 — Check SharePoint version / patch level:

# Run on the SharePoint server
Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue
(Get-SPFarm).BuildVersion
# Compare against Microsoft's July 2026 CU build numbers:
# SharePoint SE:   16.0.18827.12000+
# SharePoint 2019: 16.0.10412.20000+
# SharePoint 2016: 16.0.5488.1000+

Step 3 — Audit IIS logs for exploitation indicators:

# Search IIS logs for POST requests to /_trust/default.aspx
Get-Content "C:\inetpub\logs\LogFiles\W3SVC*\*.log" |
  Where-Object { $_ -match "POST.*/_trust/default\.aspx" } |
  Select-String -Pattern "(POST.*_trust)" |
  Select-Object -Last 200

Step 4 — Check for web shell artifacts:

# Scan SharePoint web application directories for .aspx files modified recently
Get-ChildItem -Path "C:\inetpub\wwwroot\wss\VirtualDirectories" `
  -Recurse -Filter "*.aspx" |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
  Select FullName, LastWriteTime

Automated Scanning

Nuclei template (community):

# Using ProjectDiscovery Nuclei
nuclei -u https://your-sharepoint-server \
  -id CVE-2026-50522 \
  -severity critical \
  -timeout 10

Nessus / Tenable:

  • Plugin ID search: CVE-2026-50522
  • Scan policy: "Windows Patch Audit" + "Web Application Tests"
  • Ensure credentials are provided for authenticated build-version checks

Microsoft's own tooling:

# Microsoft Safety Scanner (run on SharePoint server)
# Download: https://www.microsoft.com/en-us/wdsi/defenses/safety-scanner-download
.\msert.exe /F:Y /Q

Code Review Checklist

  • Confirm /_trust/ endpoint is not accessible from untrusted networks
  • Verify BinaryFormatter usage is absent or restricted in SharePoint customizations
  • Check web.config for hardcoded or default machine keys (machineKey section)
  • Review claims-based authentication configurations for custom token handlers
  • Audit custom ASPX pages deployed under SharePoint virtual directories
  • Verify no unauthorized accounts have been added to SharePoint admin groups recently

4. How to Fix It (Mitigation)

Step-by-Step Remediation

Phase 1: Emergency Containment (Do now, before patching if needed)

  1. Block external access to /_trust/default.aspx at your WAF/reverse proxy. Add a rule to return 403/drop for all requests matching the path from external IPs. This prevents unauthenticated exploitation while patching.

  2. Isolate internet-facing SharePoint servers from internal networks if full patching cannot happen immediately. Place emergency firewall rules restricting inbound traffic to known IPs only.

  3. Check for active compromise (see detection steps above) — if web shells or unusual POST patterns exist in logs dated after July 14, treat the server as compromised.

Phase 2: Apply the Patch

  1. Download and apply the July 2026 SharePoint Cumulative Update from Microsoft Update Catalog:

  2. Run SharePoint Products Configuration Wizard after installing the CU:

    # Run as administrator on each SharePoint server in the farm
& "$env:CommonProgramFiles\Microsoft Shared\Web Server Extensions\16\BIN\PSConfig.exe" `
  -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install `
  -cmd installfeatures -cmd secureresources -cmd services -install

  3. Verify the patch applied successfully:

    Add-PSSnapin Microsoft.SharePoint.PowerShell
(Get-SPFarm).BuildVersion

Phase 3: Rotate Machine Keys (CRITICAL — patch alone is insufficient)

  1. Generate new machine keys:

    # Generate cryptographically secure random keys
$validationKey = -join ((0..63) | ForEach-Object { '{0:X2}' -f (Get-Random -Max 256) })
$decryptionKey = -join ((0..23) | ForEach-Object { '{0:X2}' -f (Get-Random -Max 256) })
Write-Host "New validationKey: $validationKey"
Write-Host "New decryptionKey: $decryptionKey"

  2. Update web.config on all SharePoint web applications:

    <!-- Before: vulnerable/potentially-stolen keys -->
<machineKey validationKey="OLD_KEY" decryptionKey="OLD_KEY" 
            validation="HMACSHA256" decryption="AES" />

<!-- After: new keys applied after patching -->
<machineKey validationKey="NEW_GENERATED_KEY" decryptionKey="NEW_GENERATED_KEY" 
            validation="HMACSHA256" decryption="AES" />

  3. Perform an IISReset on all front-end servers after updating machine keys — this invalidates all existing session tokens and forces re-authentication.

Phase 4: Incident Response (If Compromise Suspected)

  1. Preserve IIS logs, event logs, and memory dumps before remediation if forensic analysis is planned
  2. Reset passwords for all SharePoint service accounts and managed accounts
  3. Audit Azure AD / Active Directory for new admin accounts or group membership changes
  4. Review SharePoint site permissions for unauthorized access changes

Configuration Hardening

Immediately after patching, apply these additional hardening measures:

<!-- web.config: Disable BinaryFormatter explicitly (defense in depth) -->
<configuration>
  <runtime>
    <AppContextSwitchOverrides 
      value="Switch.System.Runtime.Serialization.Formatters.Binary.BinaryFormatter.EnableUnsafeBinaryFormatterSerialization=false"/>
  </runtime>
</configuration>

# Disable WS-Federation endpoint if your org doesn't use it
# (Check first — disabling may break ADFS-integrated authentication)
$webApp = Get-SPWebApplication "https://your-sharepoint-server"
$webApp.IisSettings[Microsoft.SharePoint.Administration.SPUrlZone]::Default
# Review ClaimsAuthenticationProviders before disabling

5. How to Test the Fix (Validation)

Regression Test Scenarios

  • Scenario A — Patch validation: Confirm SharePoint build version reflects July 2026 CU across all farm servers
  • Scenario B — Attack vector blocked: Attempt the PoC exploit against the patched server and confirm it fails with an HTTP error (not code execution)
  • Scenario C — Machine key rotation: Confirm existing sessions are invalidated post-rotation and users must re-authenticate
  • Scenario D — Functionality intact: Verify normal SharePoint operations (document access, search, workflows) work correctly post-patch

Security Test Cases

Test Case 1: Verify RCE no longer possible

  • Precondition: July 2026 CU applied; machine keys rotated; IISReset performed
  • Steps: Attempt POST to /_trust/default.aspx with BinaryFormatter gadget chain payload
  • Expected Result: HTTP 400/500 error without code execution; no web shell created; no outbound connection from server

Test Case 2: Machine key forgery blocked

  • Precondition: New machine keys generated and deployed
  • Steps: Attempt to forge a SharePoint authentication token using previously observed/stolen machine keys
  • Expected Result: Token validation fails; HTTP 401 returned; access denied

Test Case 3: No unauthorized web shells persist

  • Precondition: Web shell scan completed per detection steps
  • Steps: Attempt to access any .aspx files identified in forensic scan
  • Expected Result: Files either removed or return 404; no web shell execution possible

Automated Validation Tests

# Quick patch verification script
function Test-SharePointPatchStatus {
    param([string]$MinBuildVersion = "16.0.18827.12000")
    
    Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue
    $farmBuild = (Get-SPFarm).BuildVersion.ToString()
    
    if ([Version]$farmBuild -ge [Version]$MinBuildVersion) {
        Write-Host "[PASS] SharePoint farm build $farmBuild meets minimum patched version" -ForegroundColor Green
    } else {
        Write-Host "[FAIL] SharePoint farm build $farmBuild is BELOW patched version $MinBuildVersion" -ForegroundColor Red
    }
}

Test-SharePointPatchStatus

# Verify machine key was changed (compare to known-compromised window)
function Test-MachineKeyRotated {
    $webConfigPath = "C:\inetpub\wwwroot\wss\VirtualDirectories\*\web.config"
    Get-ChildItem $webConfigPath | ForEach-Object {
        $content = Get-Content $_.FullName
        $machineKeyLine = $content | Select-String "machineKey"
        $lastModified = $_.LastWriteTime
        
        if ($lastModified -lt [DateTime]"2026-07-14") {
            Write-Host "[WARN] $($_.FullName) — machine key may not have been rotated (last modified: $lastModified)" -ForegroundColor Yellow
        } else {
            Write-Host "[OK] $($_.FullName) — updated $lastModified" -ForegroundColor Green
        }
    }
}

Test-MachineKeyRotated

6. Prevention & Hardening

Best Practices

  • Apply Patch Tuesdays within 72 hours for Critical-rated SharePoint vulnerabilities. The window between patch publication and active exploitation is shrinking — CVE-2026-50522 went from patch to PoC to exploitation in 6 days.

  • Never expose SharePoint management endpoints to the internet without strong authentication controls. The /_trust/ path should be blocked at your WAF for requests from untrusted source IPs if ADFS integration is not needed externally.

  • Rotate machine keys on a regular cadence (quarterly minimum, immediately after any suspected compromise). Document keys in a secret manager (Azure Key Vault, HashiCorp Vault) rather than only in web.config.

  • Eliminate BinaryFormatter usage in custom SharePoint code. Microsoft's own guidelines have deprecated BinaryFormatter since .NET 5. Audit all custom web parts, event receivers, and ASPX pages for deserialization code.

  • Maintain SharePoint on a supported lifecycle. SharePoint 2016 is approaching end of mainstream support — organizations still running it face escalating risk as the patching investment from Microsoft decreases.

Monitoring & Detection

IIS Log Monitoring (SIEM rules):

# Alert on POST requests to /_trust/default.aspx from external IPs
cs-method=POST AND cs-uri-stem="/_trust/default.aspx" AND NOT (c-ip IN [trusted_ip_ranges])

# Alert on new .aspx files created in SharePoint directories
EventID=4663 AND ObjectName LIKE "%\\wss\\VirtualDirectories\\%" AND ObjectName LIKE "%.aspx"

Windows Event Log indicators:

  • Event ID 4624 (Logon) with unusual service account logon from new IPs post-exploitation
  • Event ID 4688 (Process Creation) showing w3wp.exe spawning cmd.exe or powershell.exe — a strong indicator of web shell RCE
  • Event ID 4698 (Scheduled Task Created) if attacker establishes persistence

Network-level detection:

  • Alert on outbound connections from SharePoint IIS worker process (w3wp.exe) to external IPs
  • Monitor for unusual DNS queries originating from SharePoint servers
  • Watch for large outbound data transfers from SharePoint servers during off-hours

Endpoint Detection:

# Microsoft Defender for Endpoint KQL query
DeviceProcessEvents
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe")
| where DeviceName contains "sharepoint"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

Longer-Term Architecture Recommendations

  1. Move to SharePoint Online where Microsoft manages patching at cloud scale — on-premises SharePoint has had six RCE vulnerabilities exploited in active attacks in 2026 alone.
  2. Implement a Web Application Firewall in front of any internet-facing SharePoint deployment with rules for deserialization patterns in POST bodies.
  3. Segment SharePoint servers from core AD infrastructure so a compromised SharePoint server cannot directly reach domain controllers.
  4. Run SharePoint application pools under Group Managed Service Accounts (gMSA) with minimal privilege — this limits what an attacker can do post-RCE.

References

Latest from the blog

See all →