Thought Leadership
Security researchers are tracking attacks against Microsoft SharePoint systems exploiting the vulnerability CVE-2026-50522. Attackers are stealing machine keys from compromised servers.
Following the publication of functional proof-of-concept code online, security firms have detected attacks targeting on-premises Microsoft SharePoint installations. Microsoft addressed the critical vulnerability, tracked as CVE-2026-50522, as part of its July 2026 security updates. IT security company watchTowr observed the first attempts to exploit vulnerable systems shortly after the proof-of-concept code was published.
watchTowr described the timeline of the attacks as follows:
“On July 20, watchTowr identified proof-of-concept exploit code for this vulnerability. Within hours, our global honeypot network, Attacker Eye, detected exploitation attempts using this PoC that successfully compromised target systems.”
watchTowr
Attackers Steal Machine Keys to Maintain Persistent Access
As part of the attacks, threat actors steal so-called machine keys from compromised SharePoint servers. These keys allow attackers to generate valid authentication tokens, enabling them to impersonate legitimate users and access SharePoint sites and documents even after the underlying vulnerability has been patched on the affected servers.
The threat intelligence company Defused had already detected suspicious deserialization activity targeting SharePoint systems on July 17.
How the Deserialization Attack Works and How to Defend Against It
The vulnerability is caused by a flaw in the deserialization of untrusted data at the /_trust/default.aspx endpoint. The publicly available proof-of-concept code uses a specially crafted binary payload embedded in a forged authentication cookie within a WS-Federation sign-in response.
When the server processes the token, an attacker can execute arbitrary code remotely without prior authentication. In addition to installing Microsoft’s latest security updates, IT security experts recommend rotating all credentials and keys on potentially affected systems.
(ll)
