Active SharePoint RCE flaw exploited to steal machine keys
▼ Summary
– Hackers are exploiting CVE-2026-50522, a critical deserialization vulnerability in Microsoft SharePoint, to steal machine keys and maintain access even after patching.
– An attacker with stolen machine keys can create valid authentication tokens to impersonate users and access SharePoint resources.
– The flaw was addressed in Microsoft’s July security updates, but watchTowr detected exploitation attempts within hours of a public proof-of-concept (PoC) exploit being released.
– The PoC exploit, published on GitHub by researcher Janggggg, triggers remote code execution by delivering a malicious .NET payload via a forged cookie to SharePoint’s `/_trust/default.aspx` endpoint.
– watchTowr advises defenders to rotate credentials on any potentially exposed assets, as applying the SharePoint security update alone does not remove stolen keys.
Hackers are actively exploiting the critical CVE-2026-50522 vulnerability in Microsoft SharePoint to pilfer machine keys, enabling persistent access even after affected servers receive security patches. Once attackers obtain these keys, they can forge valid authentication tokens, impersonate legitimate users, and access SharePoint sites, documents, and other resources with the same privileges as the impersonated identity.
Microsoft classifies this security flaw as a deserialization-of-untrusted-data issue, allowing a remote attacker to execute code over a network without requiring authentication. The company addressed the vulnerability in its July security updates. While it wasn’t flagged as actively exploited at that time, the advisory did note an increased likelihood of it being weaponized.
Offensive security firm watchTowr has observed hackers immediately leveraging CVE-2026-50522 against vulnerable on-premise SharePoint deployments after a valid proof-of-concept (PoC) exploit became publicly available. “On July 20th, watchTowr identified proof-of-concept exploit code for this vulnerability,” the firm stated. “Within hours, our global honeypot network, Attacker Eye, captured exploitation attempts using this PoC that successfully compromised target systems.” The researchers emphasize that the attackers are specifically stealing machine keys, which allows them to maintain long-term access on breached systems.
Early warning threat intelligence company Defused detected “an undocumented SharePoint deserialization vector” being used in attacks as early as July 17, though it could not initially link the activity to a specific flaw. Yesterday, the company confirmed that the attacks were likely driven by exploitation of CVE-2026-50522.
A PowerShell-based demonstrative exploit for CVE-2026-50522 is now available on GitHub from security researcher Janggggg. The PoC attempts to trigger remote code execution by delivering a malicious . NET ‘BinaryFormatter’ payload as the cookie of a forged ‘SecurityContextToken’ within a WS-Federation sign-in response posted to SharePoint’s `/_trust/default.aspx` endpoint. If the token is processed by a vulnerable deserialization path, the payload results in arbitrary code execution on the SharePoint server. BleepingComputer did not test the PoC exploit, but it appears structurally and technically legitimate.
Notably, Janggggg published the PoC on the same day watchTowr began detecting exploitation attempts. However, it remains unclear whether the observed incidents used this publicly available code. While applying the latest SharePoint security updates removes the vulnerability, watchTowr advises defenders to also rotate credentials on any asset that may have been exposed.
(Source: BleepingComputer)
