---

📌 Executive Snapshot

Field	Finding
Vulnerability	CVE-2026-50522
Product	Microsoft SharePoint Server on-premises
Affected versions	SharePoint Server 2016, SharePoint Server 2019, SharePoint Server Subscription Edition before fixed builds
Weakness	CWE-502 — Deserialization of Untrusted Data
Impact	Remote Code Execution
CVSS v3.1	9.8 Critical — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	0.571010 / 98.974 percentile as of 2026-07-27
CISA KEV	Added 2026-07-22; due 2026-07-25
Ransomware usage	Unknown per CISA KEV
Public PoC	Reported available; GitHub repositories observed
Active exploitation	Confirmed by CISA KEV and public-sector/security reporting
Primary risk	RCE plus SharePoint/IIS machine-key theft enabling token forgery and persistence

---

🚨 Key Takeaways

CVE-2026-50522 is not a routine patching item. It is a Critical RCE with public exploit reporting, KEV status, and observed machine-key theft.

• Attackers have reportedly abused the flaw to obtain SharePoint machine keys.
• Stolen machine keys can allow forged authentication tokens and access that may survive patching.
• Patching closes the vulnerability, but exposed servers still require hunting and key rotation.
• Internet-facing on-premises SharePoint servers should be handled as emergency risk.

---

🧭 Attack Path

flowchart TD
    A[Remote attacker] --> B[Reachable on-prem SharePoint]
    B --> C[Crafted request to sign-in/auth surface]
    C --> D[Unsafe deserialization]
    D --> E[Remote code execution]
    E --> F[Machine-key theft]
    F --> G[Forge auth tokens/cookies]
    G --> H[Impersonate users]
    H --> I[Access SharePoint sites and documents]
    F --> J[Persistence after patch if keys not rotated]

---

🧩 Affected Versions and Fixes

Product	Vulnerable before	Required fixed build	Patch
SharePoint Server 2016 / Enterprise Server 2016	16.0.5561.1001	16.0.5561.1001 or later	KB5002891
SharePoint Server 2019	16.0.10417.20175	16.0.10417.20175 or later	KB5002883
SharePoint Server Subscription Edition	16.0.19725.20434	16.0.19725.20434 or later	KB5002882

---

🧠 Root Cause Summary

ZDI identifies the affected area as the SessionSecurityTokenHandler class. The flaw is caused by insufficient validation of user-supplied data, enabling unsafe deserialization and remote code execution in affected SharePoint installations.

Public reporting describes a PoC path involving SharePoint sign-in processing and /_trust/default.aspx. Exact implementation details are limited because SharePoint source and patch diff are not public.

---

🔥 Threat Intelligence Summary

Item	Status	Confidence
Active exploitation	Confirmed by CISA KEV	High
Public PoC	Reported; GitHub repositories found	Medium
Exploit-DB entry	Not Found	Medium-High
Metasploit module	Not Found	Medium
Named threat actor	Not Found	Medium
Ransomware campaign	Unknown per CISA	High
Machine-key theft	Reported by multiple sources	High

---

🕒 Investigation Timeline

timeline
    title CVE-2026-50522 Timeline
    2026-05-21 : Reported to vendor via ZDI/Pwn2Own path
    2026-07-14 : Microsoft advisory and patches released
    2026-07-15 : ZDI advisory published
    2026-07-17 : Exposure advisory and early exploitation reporting window
    2026-07-20 : Public PoC reportedly appears; exploitation observed within hours
    2026-07-22 : CISA adds CVE-2026-50522 to KEV
    2026-07-25 : CISA remediation due date
    2026-07-27 : Report finalized

---

🛠️ Defender Action Plan

Immediate — First 24 Hours

• Inventory all on-premises SharePoint servers.
• Prioritize internet-facing and partner-accessible farms.
• Apply Microsoft July 2026 SharePoint updates.
• Verify fixed builds across every farm member.
• Preserve IIS, ULS, WAF, Defender, Windows, and EDR logs.
• Hunt for suspicious POST /_trust/default.aspx activity.
• Hunt for w3wp.exe spawning command-line tools.
• Hunt for new/modified .aspx, .ashx, .asmx, .dll, and web.config files.
• Review Microsoft Defender/AMSI detections.
• Rotate machine keys after cleanup.

Hardening — Next 7 Days

• Enable/verify AMSI integration for every SharePoint web application.
• Use Request Body Scan Full Mode where feasible.
• Remove direct internet exposure.
• Place SharePoint behind authenticated Layer 7 reverse proxy/WAF.
• Block external Central Administration access.
• Restrict farm/database communications.
• Review service accounts, farm admins, timer jobs, scheduled tasks, and farm solutions.
• Plan migration away from unsupported SharePoint 2016/2019 where applicable.

---

🔎 High-Value Detection Ideas

Web / IIS / WAF

POST /_trust/default.aspx
AND request contains any of:
  SecurityContextToken
  BinaryFormatter
  AAEAAAD

Endpoint / EDR

Parent process: w3wp.exe
Child process: cmd.exe, powershell.exe, pwsh.exe, certutil.exe, bitsadmin.exe,
               mshta.exe, rundll32.exe, regsvr32.exe, cscript.exe, wscript.exe

File Integrity

Monitor:
C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\
C:\inetpub\wwwroot\wss\VirtualDirectories\

Alert on new or modified:
*.aspx, *.ashx, *.asmx, *.dll, web.config

Microsoft Defender / AMSI Detections From CISA Guidance

Exploit:Script/SuspSignoutReqBody.A
Exploit:Script/ToolPaneAuthBypass.A
Exploit:Script/ToolPaneAuthBypass.C
Backdoor:MSIL/LeakFang.A!dha

---

📊 Risk Matrix

Exposure	Likelihood	Impact	Priority
Internet-facing vulnerable SharePoint	High	Critical	P0
Partner/VPN-accessible vulnerable SharePoint	High	Critical	P0/P1
Internal-only vulnerable SharePoint with broad access	Medium-High	High	P1
Patched but exposed before remediation	Medium	High	P1 — hunt and rotate
Patched, hunted, keys rotated, hardened	Low-Medium	Medium	Monitor

---

✅ Verified Indicators and Gaps

Category	Result
Attacker IPs	Not Found
Attacker domains	Not Found
Full malicious URLs	Not Found
Malicious file hashes	Not Found
Registry keys	Not Found
Mutexes	Not Found
Verified network path	/_trust/default.aspx
Verified detection names	Microsoft Defender/AMSI names listed above
Verified sensitive target	SharePoint/IIS machine keys

---

📚 Full Report

The detailed analyst report is available in this repository:

➡️ CVE-2026-50522_CTI_Report.md

It includes: