Hackers exploit critical SharePoint flaw to steal machine keys
This digest was compiled by AI from multiple sources — links to the originals are below.
Attackers are actively exploiting CVE-2026-50522, a critical remote code execution vulnerability in Microsoft SharePoint, to steal machine keys and maintain persistent access. The flaw, patched in July's security updates, allows unauthenticated remote code execution via deserialization of untrusted data. watchTowr detected exploitation attempts within hours of a public proof-of-concept exploit being released on GitHub.
The Vulnerability
CVE-2026-50522 is a critical deserialization-of-untrusted-data flaw in Microsoft Office SharePoint, with a CVSS score of 9.8. Microsoft patched it in the July 2026 Patch Tuesday updates but did not mark it as actively exploited at the time, though the advisory noted an increased likelihood of exploitation. The flaw allows an unauthenticated attacker to execute code remotely over a network.
Active Exploitation
Offensive security company watchTowr observed exploitation attempts starting July 20, hours after a proof-of-concept exploit was published on GitHub by security researcher Janggggg. watchTowr's global honeypot network, Attacker Eye, captured successful compromises. Early warning firm Defused detected an undocumented SharePoint deserialization vector as early as July 17, later linking it to CVE-2026-50522. Attackers are stealing machine keys to maintain long-term access even after patching.
CISA Advisory
The US Cybersecurity and Infrastructure Security Agency (CISA) urged organizations to immediately secure SharePoint deployments, adding CVE-2026-50522 to its Known Exploited Vulnerabilities (KEV) catalog. CISA's advisory also highlighted two other actively exploited SharePoint flaws: CVE-2026-332201 and CVE-2026-45659. Experts recommend rotating credentials on exposed assets and implementing network segmentation to limit damage.
What's Next
Organizations are urged to apply the July security patches and rotate credentials on potentially compromised systems. It remains unclear how many organizations have been breached, and whether the public PoC exploit is the same one used in the observed attacks.
34 sources
Hackers exploit critical SharePoint flaw to steal machine keys
bleepingcomputer.com
BleepingComputer
bleepingcomputer.com
BleepingComputer
bleepingcomputer.com
BleepingComputer
bleepingcomputer.com
BleepingComputer
csoonline.com
CSO Online
csoonline.com
CSO Online
csoonline.com
CSO Online
csoonline.com
CSO Online
csoonline.com
CSO Online
computerworld.com
Computerworld
computerworld.com
Computerworld
computerworld.com
Computerworld
darkreading.com
Dark Reading
darkreading.com
Dark Reading
securityweek.com
Security Week
techradar.com
TechRadar
thehackernews.com
The Hacker News
thehackernews.com
The Hacker News
thehackernews.com
The Hacker News
thehackernews.com
The Hacker News
thehackernews.com
The Hacker News
thehackernews.com
The Hacker News
thehackernews.com
The Hacker News
thehackernews.com
The Hacker News
thehackernews.com
The Hacker News
thehackernews.com
The Hacker News
thehackernews.com
The Hacker News
thehackernews.com
The Hacker News
thehackernews.com
The Hacker News
malwarebytes.com
Malwarebytes Labs
malwarebytes.com
Malwarebytes Labs
securityweek.com
Security Week
helpnetsecurity.com
Help Net Security
scworld.com
SC Media
