Executive Summary
A ThreatLocker report published on 21 July 2026 detailed two critical deserialization vulnerabilities, CVE-2026-50522 and CVE-2026-58644, affecting on-premises Microsoft SharePoint Server deployments. The flaws can allow an authenticated attacker to submit malicious serialized data that is processed by vulnerable SharePoint components, resulting in remote code execution within the SharePoint server context.
Successful exploitation could enable command execution, malware or webshell deployment, credential theft, access to SharePoint data, and persistence within affected environments.
Social media posts by cybersecurity firms watchTowr and Defused claim that CVE-2026-50522 is being actively exploited. Microsoft has released security updates for affected SharePoint Server 2016, 2019, and Subscription Edition deployments.
Key Takeaways
- CVE-2026-50522 has a severity score of 9.8 and results from insufficient validation before user-supplied data is deserialized by the SessionSecurityTokenHandler class within the Windows Identity Foundation token processing framework.
- Exploitation involves sending a specially crafted request to an unpatched SharePoint server, where attacker-controlled data reaches an authentication or session token processing path and is interpreted as a serialized object.
- Inadequate type or content validation may allow a usable .NET gadget or related execution path to execute code within the SharePoint server context.
- CVE-2026-58644 similarly permits malicious serialized data to be accepted and reconstructed into attacker-controlled object graphs, enabling server-side code execution.
- ThreatLocker stated that exploitation requires privileges of at least site owner, which is one level of privilege above a site member or visitor.
- Successful exploitation may permit arbitrary command or assembly execution, webshell deployment, access to SharePoint content databases and configuration data, theft of service-account credentials, token forgery, and lateral movement.
- Attackers may target IIS or ASP.NET machine keys, which could allow them to generate authentication or application-state material that a SharePoint server accepts as legitimate.
- Patching prevents exploitation of the vulnerabilities but may not remove established persistence if attackers previously obtained IIS or ASP.NET machine keys.
- Affected products include vulnerable builds of Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.
Mitigation Options
ThreatLocker Threat Intelligence team provided the following mitigations:
- Immediately install the latest cumulative security updates for Microsoft SharePoint Server 2016, 2019, and Subscription Edition.
- Confirm that deployed SharePoint versions meet or exceed the patched build numbers provided by Microsoft.
- Organizations with Zero Trust Endpoint Firewall or Zero Trust Network Access (ZTNA) should restrict access to on premise SharePoint servers to only explicitly approved devices.
