Critical SharePoint RCE Exploited on Internet-Exposed On-Prem Servers
Active Exploitation · 4 sources · Updated 3mo ago · First seen Aug 1, 2026
Government cyber authorities in Colombia and Panama warned about a critical Microsoft SharePoint Server vulnerability affecting on-premises deployments, with Panama identifying the flaw as CVE-2026-50522. The bug is an unauthenticated remote code execution issue tied to CWE-502 insecure deserialization in SharePoint Server 2016, 2019, and Subscription Edition, reportedly reachable through the /_trust/default.aspx WS-Federation endpoint using crafted tokens. The alerts emphasize that SharePoint Online is not affected, while Internet-exposed on-premises servers face the highest risk.
Microsoft released patches, but public reporting cited subsequent proof-of-concept activity followed by broad exploitation of exposed servers, prompting CISA to add CVE-2026-50522 to its Known Exploited Vulnerabilities catalog. CSIRT Panamá warned that attackers could steal IIS machine keys, forge authentication tokens, and maintain access even after patching unless affected organizations also rotate keys and restart IIS or SharePoint services. Defenders were urged to patch immediately, assume exposed servers may already be compromised, reduce Internet exposure, and review logs and webshell indicators for signs of intrusion.
