Critical SharePoint Flaw Exposes Machine Keys to Active Exploitation
The cybersecurity landscape in 2026 is seeing an aggressive shift, with threat actors rapidly weaponizing public proof-of-concept (PoC) code to compromise critical infrastructure. Among the most concerning developments is the active exploitation of the CVE-2026-50522 critical remote code execution (RCE) flaw in Microsoft SharePoint. This vulnerability—a deserialization-of-untrusted-data issue—has been leveraged to steal machine keys, granting attackers the ability to impersonate users and maintain long-term persistence within compromised environments.
What makes this situation particularly urgent isn't just that the flaw exists, but that attackers moved fast. watchTowr, an offensive security firm, observed exploitation attempts against on-premise SharePoint deployments within hours of a valid PoC exploit becoming public. Even more troubling: threat intelligence firm Defused detected suspicious activity as early as July 17, 2026—before the PoC was even published—suggesting sophisticated actors were already probing the vulnerability.
The Anatomy of the CVE-2026-50522 Attack
The vulnerability originates from a flaw in how SharePoint handles serialized data, allowing an unauthenticated remote attacker to execute arbitrary code. The exploitation technique involves delivering a malicious .NET 'BinaryFormatter' payload encapsulated within a security context token, which is then posted to the SharePoint /_trust/default.aspx endpoint.
Here's how it works in practice: an attacker crafts a forged WS-Federation sign-in response containing a malicious SecurityContextToken. This token, carrying a BinaryFormatter payload as its cookie, gets posted to SharePoint's trust endpoint. When the server processes this forged token through the vulnerable deserialization path, it executes the payload—resulting in arbitrary code execution on the SharePoint server.
Microsoft describes the issue as a "deserialization-of-untrusted-data" flaw that allows a remote attacker to execute code over a network without authentication. While the technical detail is nuanced, the impact is severe: full, unauthenticated code execution.
Rapid Weaponization and Active Exploitation
The vulnerability's lifecycle illustrates the speed at which modern threats evolve. Intelligence firms like watchTowr have reported that exploitation attempts against on-premise SharePoint deployments escalated rapidly—within hours of a valid PoC exploit being published publicly by researcher Janggggg on July 20, 2026. Prior to this PoC, other security vendors like Defused had observed suspicious deserialization vectors as early as July 17, underscoring that sophisticated actors were already investigating the flaw.
Defused initially detected "an undocumented SharePoint deserialization vector" being used in attacks but couldn't link the activity to a specific flaw. By July 20, they concluded the attacks were likely driven by exploiting CVE-2026-50522.
This rapid transition from a disclosed vulnerability to active exploitation is a defining characteristic of contemporary AI cybersecurity threats. Attackers are increasingly utilizing automated reconnaissance and vulnerability analysis tools to shrink the window between disclosure and weaponization.
It's worth noting that Microsoft did not mark this vulnerability as "actively exploited" in its advisory. Instead, the company assigned it an "increased likelihood of being leveraged" designation—a distinction that matters when assessing risk. However, watchTowr's observations of real-world exploitation attempts immediately following the PoC's publication suggest the reality on the ground diverged from Microsoft's assessment.
The Persistence Problem: Machine Key Theft
What makes CVE-2026-50522 particularly dangerous is not just the initial RCE, but the subsequent persistence strategy. Threat actors are utilizing this exploit to compromise machine keys. By gaining control over these keys, attackers can generate valid authentication tokens.
This effectively allows them to impersonate any user within the target environment, bypassing standard authentication controls. Even after an organization patches the underlying SharePoint vulnerability, the attacker may maintain persistent, authorized access by leveraging these forged tokens, making remediation far more complex than a routine update.
An attacker who obtains these machine keys can create valid authentication tokens to impersonate users and access available resources such as SharePoint sites and documents with the privileges of the forged identity. This persistence mechanism is what transforms a simple vulnerability into a long-term threat.
Securing Your Infrastructure: Beyond Patching
Defending against such sophisticated persistence mechanisms requires moving beyond simple patch management. Organizations must adopt a layered strategy for AI agent security and robust identity control planes.
Recommended Defensive Actions:
-
Immediate Patching: The primary remediation step is to apply the July 2026 Microsoft security updates immediately. These updates close the deserialization path that allows the execution.
-
Credential Rotation: Because the exploit facilitates the theft of machine keys, patching alone is insufficient. Security teams must rotate credentials for all exposed assets to invalidate any forged authentication tokens generated by the attacker. watchTowr specifically advises rotating credentials on any asset that may have been exposed.
-
Agentic Security Monitoring: Incorporating advanced threat detection capabilities for agent infrastructure—often powered by AI agents capable of monitoring for anomalous behavior in authentication logs—is crucial for identifying the artifacts of impersonation and persistence that legacy security controls might overlook.
-
Adherence to CISA Guidelines: As outlined in standard Cybersecurity Best Practices, continuous monitoring and proactive threat hunting are critical to identifying and neutralizing adversaries who may have already established a foothold using these advanced tactics.
One detail worth emphasizing: the PowerShell demonstrative exploit for CVE-2026-50522 available on GitHub from researcher Janggggg looks "structurally and technically legitimate," according to BleepingComputer, though the publication did not test it. It's also unclear whether the observed incidents made use of the publicly available exploit or predated it—the timing of the PoC's publication coincides exactly with watchTowr's first detection of attacks, leaving open the question of whether threat actors were already weaponizing the flaw before it went public.
In this era, where AI-driven cyber threats can compromise infrastructure at scale, organizations must treat credential integrity with the same urgency as vulnerability management. The combination of vulnerability remediation and stringent credential rotation is the only reliable defense against the long-term impersonation threats introduced by CVE-2026-50522.
