Attackers are exploiting a critical SharePoint remote code execution (RCE) vulnerability (CVE-2026-50522) to extract the servers’ IIS machine keys.
“WatchTowr is observing active exploitation of CVE-2026-50522 against on-premise Microsoft SharePoint deployments following the release of public exploit code, with attackers stealing machine keys to retain long-term access,” the offensive security company warned on Tuesday.
WatchTowr’s global honeypot network registered successful exploitation attempts on July 20, mere hours after the release of the proof-of-concept exploit and less than a week after Microsoft confirmed that CVE-2026-56164 (an privilege elevation flaw) and CVE-2026-58644 (a RCE vulnerability) are being actively exploited by attackers.
On July 17, threat intelligence firm Defused also spotted what they now believe to be CVE-2026-50522 exploitation attempts.
“The captured requests carry no authentication material, matching 50522’s unauthenticated profile. Microsoft describes the paired CVE-2026-58644 as requiring Site Owner auth, which does not fit unauthenticated traffic,” they commented on Monday.
If they are right, it means that exploitation of CVE-2026-50522 started before the PoC exploit was released, but after Microsoft pushed out fixes for both flaws – earlier this month for CVE-2026-50522 and in June 2026 for CVE-2026-58644.
Patching alone won’t lock attackers out
Attackers are continuously trying to breach SharePoint servers, as they are usually reachable from the internet, hold valuable organizational data, and are integrated with other internal systems.
Internet intelligence company Censys recently mapped internet-facing SharePoint servers and says almost all of them are SharePoint Online, which are hosted, operated and patched by Microsoft.
“Counting hosts rather than web properties, about 1,500 run the self-managed, on-premises editions, predominantly SharePoint 2019 with smaller fractions identifying as 2016 and Subscription Edition,” they noted, and said that most of these are in the US.
How many of these have received the latest security updates is impossible to tell, Censys added, because “the SharePoint response header (…) limits how precisely patch status can be assessed.”
The US Cybersecurity and Infrastructure Security Agency issued a warning last week about a slew of SharePoint vulnerabilities targeted by attackers and urged organizations running self-managed server instances to:
- Implement security updates quickly
- Verify that Antimalware Scan Interface (AMSI) integration is enabled for each SharePoint web application (and monitor for detections)
- Implement a number of hardening measures
- Hunt for and remediate any intrusion artifacts before rotating IIS machine keys
Organizations that haven’t yet implemented the SharePoint updates released on July 14 should not skip that last step.
“Patching is not enough, defenders should rotate credentials on any assets that may have been exposed,” watchTowr advised.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
