Critical SharePoint RCE Flaw Exploited to Steal Machine Keys, Granting Persistent Access

Hackers are actively exploiting the critical vulnerability identified as CVE-2026-50522 in Microsoft SharePoint, leveraging it to steal machine keys and establish persistent access to compromised systems, even after affected servers have been updated and patched. This exploitation grants attackers the ability to forge authentication tokens, effectively impersonating legitimate users and gaining unauthorized access to sensitive resources such as SharePoint sites and documents with the full privileges of the stolen identity.

Understanding the Critical Vulnerability

Microsoft officially describes CVE-2026-50522 as a severe deserialization-of-untrusted-data flaw. This particular type of vulnerability allows a remote attacker to execute arbitrary code over a network without requiring any prior authentication. Deserialization, in the context of software, is the process of converting a stream of bytes back into a live object. When an application deserializes untrusted data without proper validation, an attacker can embed malicious code within that data stream. When the application attempts to reconstruct the object, it inadvertently executes the attacker’s code, leading to potentially devastating consequences, including remote code execution (RCE).

SharePoint, a cornerstone of collaboration and document management for countless organizations worldwide, often handles vast amounts of sensitive data and critical business processes. Its ubiquitous presence in enterprise environments makes any severe vulnerability, especially one allowing unauthenticated RCE, a prime target for malicious actors. A successful exploit can lead to data breaches, intellectual property theft, system compromise, and significant operational disruption. The severity is further amplified by the fact that this flaw allows attackers to bypass authentication entirely, making it an ideal entry point for initial compromise.

Chronology of Discovery and Exploitation

The timeline surrounding CVE-2026-50522 reveals a rapid transition from vulnerability disclosure to active exploitation, underscoring the relentless pace of cyber threats.

• Early Warnings (July 17th): Threat intelligence company Defused began detecting suspicious activity as early as July 17th. Their observations pointed to the use of "an undocumented SharePoint deserialization vector" in active attacks. At this initial stage, the activity could not be definitively linked to a specific, known vulnerability. These early detections highlight the proactive monitoring capabilities of advanced threat intelligence platforms, often catching nascent attack trends before official disclosures.

• Microsoft’s Patch Tuesday (July 2026): Microsoft released its monthly security updates, commonly known as "Patch Tuesday," in July 2026. This update included a fix for CVE-2026-50522. While the vulnerability was categorized as critical, Microsoft’s advisory did not initially mark it as "actively exploited." However, it did note an "increased likelihood of being leveraged," a common indicator from Microsoft for vulnerabilities that are technically feasible to exploit and pose a significant risk. This assessment, in retrospect, proved prescient.

  

• Proof-of-Concept Emergence (July 20th): On July 20th, an offensive security company, watchTowr, identified and confirmed the existence of a functional proof-of-concept (PoC) exploit code for CVE-2026-50522. This PoC was quickly made public, a common occurrence in the cybersecurity research community, which can serve to help defenders understand the threat but also unfortunately accelerate its weaponization by attackers.

• Immediate Exploitation Confirmed (Hours Later, July 20th): The window between a public PoC release and active exploitation was exceptionally narrow. watchTowr’s global honeypot network, named Attacker Eye, captured exploitation attempts using this newly released PoC "within hours" of its publication. These attempts were successful in compromising target systems, confirming that malicious actors were quick to adopt and deploy the publicly available exploit. This rapid weaponization emphasizes the critical importance of immediate patching for organizations.

• Linking Early Attacks (Later, July 20th): Following the public disclosure of the vulnerability and the confirmation of active exploitation, Defused revisited its earlier observations. The company subsequently confirmed that the attacks it had detected as early as July 17th were indeed likely driven by the exploitation of the CVE-2026-50522 SharePoint vulnerability, solidifying the timeline of pre-patch and post-PoC exploitation.

The Technical Mechanism of Exploitation

The publicly available PoC exploit, demonstrated by security researcher Janggggg on GitHub, provides a clear illustration of the attack vector. The exploit leverages PowerShell to deliver a malicious .NET ‘BinaryFormatter’ payload. This payload is embedded as the cookie of a forged ‘SecurityContextToken’ within a WS-Federation sign-in response. This malicious response is then posted to SharePoint’s /_trust/default.aspx endpoint.

When the vulnerable SharePoint server processes this specially crafted token, it attempts to deserialize the untrusted data. Due to the flaw, the application fails to adequately validate the incoming data, allowing the malicious BinaryFormatter payload to be executed. This results in arbitrary code execution on the SharePoint server, granting the attacker full control over the compromised system.

The Significance of Machine Key Theft

Beyond initial remote code execution, the most alarming aspect of the observed attacks is the attackers’ focus on stealing "machine keys." Machine keys are cryptographic keys used by a server to perform various sensitive operations, including encrypting and decrypting data, signing authentication tokens, and generating session identifiers. In the context of SharePoint and Windows environments, these keys are fundamental to the system’s security and trust model.

When an attacker obtains a server’s machine keys, they gain a powerful persistence mechanism. With these keys, they can create valid authentication tokens from scratch, allowing them to impersonate any user within the SharePoint environment. This means they can bypass traditional authentication mechanisms and access any resource (sites, documents, administrative interfaces) with the privileges of the forged identity.

Crucially, the theft of machine keys provides long-term access that can persist even after the initial vulnerability (CVE-2026-50522) has been patched. Applying the security update fixes the deserialization flaw, preventing new exploitation attempts. However, if an attacker has already exfiltrated the machine keys, they can continue to generate valid authentication tokens and maintain their foothold on the network, effectively "living off the land." This renders the patching effort only partially effective without further remediation steps. The ability to forge identities means attackers can continue to operate stealthily, escalating privileges and moving laterally within the network, making detection and eradication significantly more challenging.

Broader Implications and Enterprise Risk

The active exploitation of CVE-2026-50522 carries profound implications for enterprise security:

• Data Breach Risk: SharePoint often houses sensitive corporate data, including confidential documents, intellectual property, and personal employee information. Unauthorized access through forged identities presents a direct path to massive data exfiltration.
• Systemic Compromise: A foothold on a SharePoint server can be a gateway to the broader corporate network. Attackers can use this access to launch further attacks, deploy ransomware, or establish command-and-control infrastructure.
• Trust Erosion: The ability to impersonate users undermines the entire security architecture built on identity and access management. This can lead to a complete breakdown of trust within the internal network.
• Operational Disruption: Beyond data theft, attackers could manipulate or destroy critical documents, disrupt collaborative workflows, and cripple business operations.
• Compliance and Regulatory Fines: Organizations failing to adequately protect sensitive data due to unpatched systems or insufficient incident response may face severe regulatory penalties and reputational damage.
• The "Race to Patch" Dynamic: This incident highlights the critical "race to patch" that organizations face. The gap between a vulnerability’s disclosure and its widespread exploitation is shrinking. Organizations must implement robust patch management strategies that prioritize critical vulnerabilities and ensure rapid deployment of security updates. The fact that exploitation was observed within hours of a public PoC release underscores this urgency.

Official Responses and Mitigation Strategies

Microsoft’s primary response has been the release of the security update in July 2026, which addresses the deserialization flaw. Organizations are strongly urged to apply this update immediately. However, given the nature of the machine key theft, patching alone is insufficient for systems that may have already been compromised.

Security experts, including watchTowr, are issuing critical advice to defenders:

1. Apply Security Updates: The first and most crucial step is to apply the latest SharePoint security updates to remediate CVE-2026-50522, preventing further exploitation of the deserialization vulnerability.
2. Rotate Credentials and Machine Keys: For any SharePoint asset that may have been exposed or potentially compromised, it is imperative to rotate all relevant credentials. More specifically, administrators must rotate the server’s machine keys. This invalidates any stolen keys, preventing attackers from using them to forge new authentication tokens and maintain persistent access. This process typically involves regenerating cryptographic keys used by IIS and SharePoint.
3. Conduct Comprehensive Forensics: Organizations should conduct thorough forensic investigations on potentially affected servers to identify any signs of compromise, including unauthorized access, data exfiltration, or the presence of malicious implants.
4. Enhanced Monitoring: Implement enhanced logging and monitoring for unusual activity on SharePoint servers, including failed login attempts, unusual data access patterns, and suspicious process executions.
5. Network Segmentation: Employ network segmentation to limit the blast radius of any potential compromise, isolating critical SharePoint deployments from other sensitive parts of the network.
6. Strong Authentication: Reinforce the use of multi-factor authentication (MFA) for all administrative and user accounts accessing SharePoint, adding an extra layer of security that can mitigate the impact of stolen credentials or forged tokens (though machine key forgery bypasses traditional MFA for session tokens).
7. Security Audits: Regular security audits and penetration testing of SharePoint environments can help identify and address vulnerabilities before they are exploited by malicious actors.

The active exploitation of CVE-2026-50522 serves as a stark reminder of the sophisticated and rapid nature of modern cyber threats. For organizations relying on Microsoft SharePoint, immediate action is required not only to patch the vulnerability but also to proactively address the potential for persistent access through stolen machine keys, thereby safeguarding their critical data and maintaining the integrity of their digital infrastructure. The incident underscores the continuous need for a multi-layered security approach, combining timely patching with robust incident response and proactive threat intelligence.