Loading story…
Government cyber authorities in Colombia and Panama warned about a critical Microsoft SharePoint Server vulnerability affecting on-premises deployments, with Panama identifying the flaw as CVE-2026-50522. The bug is an unauthenticated remote code execution issue tied to CWE-502 insecure deserialization in SharePoint Server 2016, 2019, and Subscription Edition, reportedly reachable through the /_trust/default.aspx WS-Federation endpoint using crafted tokens. The alerts emphasize that SharePoint Online is not affected, while Internet-exposed on-premises servers face the highest risk.
Microsoft released patches, but public reporting cited subsequent proof-of-concept activity followed by broad exploitation of exposed servers, prompting CISA to add CVE-2026-50522 to its Known Exploited Vulnerabilities catalog. CSIRT Panamá warned that attackers could steal IIS machine keys, forge authentication tokens, and maintain access even after patching unless affected organizations also rotate keys and restart IIS or SharePoint services. Defenders were urged to patch immediately, assume exposed servers may already be compromised, reduce Internet exposure, and review logs and webshell indicators for signs of intrusion.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
COLCERT issued security alert AL-20260804-108 identifying a critical vulnerability in Microsoft SharePoint Server. The supplied content does not include a CVE, affected versions, exploitation status, or remediation details.
CSIRT Panamá published an advisory warning that CVE-2026-50522 is being actively exploited against on-premises Microsoft SharePoint servers. The notice described the reported abuse of the /_trust/default.aspx WS-Federation endpoint and recommended patching, key rotation, service restarts, and reducing Internet exposure.
CISA added CVE-2026-50522 to its Known Exploited Vulnerabilities catalog, reflecting active exploitation of the SharePoint flaw. The vulnerability can enable remote code execution and subsequent persistence if IIS machine keys are stolen and not rotated.
Microsoft published the official fix for CVE-2026-50522, a critical unauthenticated remote code execution flaw in on-premises SharePoint Server 2016, 2019, and Subscription Edition. The vulnerability does not affect SharePoint Online.
COLCERT published follow-up advisory AL-20250728-069 بشأن a critical Microsoft SharePoint vulnerability. The visible excerpt only confirms the advisory and its follow-up nature, without technical details.
COLCERT published alert AL-20250720-067 identifying a critical zero-day vulnerability affecting Microsoft SharePoint Server. The supplied content does not include a CVE, affected versions, or mitigation details.
According to public reporting cited by CSIRT Panamá, a proof of concept for CVE-2026-50522 was later published and led to mass, indiscriminate exploitation of Internet-exposed SharePoint servers. The content does not explicitly anchor the PoC publication date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
colcert.gov.co
Open sourcecert.pa
Open sourcecolcert.gov.co
Open sourcecolcert.gov.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical Microsoft SharePoint remote code execution flaw, **CVE-2026-50522** (`CVSS 9.8`), is being actively exploited against on-premises deployments after Microsoft released fixes for affected versions of **SharePoint Enterprise Server 2016**, **SharePoint Server 2019**, and **SharePoint Subscription Edition**. The vulnerability stems from unsafe deserialization of untrusted data and can be triggered through unauthenticated requests, making internet-facing SharePoint farms particularly exposed. Researchers reported likely real-world exploitation against honeypots, and public proof-of-concept code is now available. Reporting indicates attackers have targeted on-prem SharePoint instances and, in some cases, stolen machine keys to help preserve long-term access. The flaw was originally demonstrated during **Pwn2Own Berlin**, where exploit code was shown and shared with Microsoft before the vendor issued patches. Organizations running exposed SharePoint servers have been urged to apply the fixed versions immediately and, if patching cannot be completed at once, restrict external access and review logs for suspicious requests to SharePoint sign-in pages.
Jul 23, 2026
More than **1,370 internet-facing Microsoft SharePoint servers** were reported exposed to active exploitation of **`CVE-2026-32201`**, a spoofing vulnerability affecting SharePoint Server 2016, 2019, and Subscription Edition. Microsoft disclosed the flaw in April and CISA added it to the **Known Exploited Vulnerabilities** catalog the same day, underscoring the urgency for defenders. Although Microsoft scored the bug at **CVSS 6.5**, the risk is elevated because it can be exploited **remotely without authentication** against exposed on-premises deployments, potentially allowing attackers to impersonate users, access or alter sensitive content, steal credentials, and move laterally inside victim environments. The exposure comes amid broader concern over SharePoint security, including Microsoft's disclosure of **`CVE-2026-26106`**, a **remote code execution** vulnerability in SharePoint Server, and earlier reporting that a **China-linked threat actor** was involved in SharePoint attacks, according to Mandiant. The concentration of exposed systems was highest in the **United States**, and the combined reporting points to sustained attacker interest in SharePoint as a route into enterprise networks. Organizations were urged to apply Microsoft's available updates, reduce direct internet exposure of SharePoint servers, and closely monitor authentication and document-access activity for signs of compromise.
Jun 29, 2026
CISA and Microsoft warned that multiple **on-premises SharePoint Server** vulnerabilities are being actively exploited against internet-facing systems, with attackers using a chain involving `CVE-2026-32201`, `CVE-2026-45659`, and `CVE-2026-56164` to gain unauthorized access, execute code, steal IIS and ASP.NET machine keys, maintain persistence, and deploy malware. The agencies said the activity affects supported on-premises SharePoint deployments rather than SharePoint Online, and follows earlier Microsoft reporting that Chinese threat actors including **Linen Typhoon**, **Violet Typhoon**, and **Storm-2603** had abused similar SharePoint flaws to install web shells, dump credentials, move laterally, and in some cases deploy **Warlock ransomware**. Microsoft’s July 2026 updates also fixed two additional critical SharePoint bugs, `CVE-2026-55040` and `CVE-2026-58644`, which were not yet confirmed as exploited but were assessed as likely targets for rapid weaponization, while separate reporting said another SharePoint exploit chain may remain unpatched pending a later release. Defenders were urged to immediately apply available patches, enable **AMSI** in Full Mode, reduce or remove internet exposure, restrict access to SharePoint Central Administration, review logs and endpoint telemetry for compromise, and only rotate IIS or ASP.NET machine keys after confirming whether intrusion activity is already present.
Jul 20, 2026