📌 Executive Snapshot

🚨 Key Takeaways

CVE-2026-50522 is not a routine patching item. It is a Critical RCE with public exploit reporting, KEV status, and observed machine-key theft.

• Attackers have reportedly abused the flaw to obtain SharePoint machine keys.
• Stolen machine keys can allow forged authentication tokens and access that may survive patching.
• Patching closes the vulnerability, but exposed servers still require hunting and key rotation.
• Internet-facing on-premises SharePoint servers should be handled as emergency risk.

🧭 Attack Path

flowchart TD
    A[Remote attacker] --> B[Reachable on-prem SharePoint]
    B --> C[Crafted request to sign-in/auth surface]
    C --> D[Unsafe deserialization]
    D --> E[Remote code execution]
    E --> F[Machine-key theft]
    F --> G[Forge auth tokens/cookies]
    G --> H[Impersonate users]
    H --> I[Access SharePoint sites and documents]
    F --> J[Persistence after patch if keys not rotated]

🧩 Affected Versions and Fixes

🧠 Root Cause Summary

ZDI identifies the affected area as the SessionSecurityTokenHandler class. The flaw is caused by insufficient validation of user-supplied data, enabling unsafe deserialization and remote code execution in affected SharePoint installations.

Public reporting describes a PoC path involving SharePoint sign-in processing and /_trust/default.aspx. Exact implementation details are limited because SharePoint source and patch diff are not public.

🔥 Threat Intelligence Summary

🕒 Investigation Timeline

timeline
    title CVE-2026-50522 Timeline
    2026-05-21 : Reported to vendor via ZDI/Pwn2Own path
    2026-07-14 : Microsoft advisory and patches released
    2026-07-15 : ZDI advisory published
    2026-07-17 : Exposure advisory and early exploitation reporting window
    2026-07-20 : Public PoC reportedly appears; exploitation observed within hours
    2026-07-22 : CISA adds CVE-2026-50522 to KEV
    2026-07-25 : CISA remediation due date
    2026-07-27 : Report finalized

🛠️ Defender Action Plan

Immediate — First 24 Hours

• Inventory all on-premises SharePoint servers.
• Prioritize internet-facing and partner-accessible farms.
• Apply Microsoft July 2026 SharePoint updates.
• Verify fixed builds across every farm member.
• Preserve IIS, ULS, WAF, Defender, Windows, and EDR logs.
• Hunt for suspicious POST /_trust/default.aspx activity.
• Hunt for w3wp.exe spawning command-line tools.
• Hunt for new/modified .aspx, .ashx, .asmx, .dll, and web.config files.
• Review Microsoft Defender/AMSI detections.

Hardening — Next 7 Days

• Enable/verify AMSI integration for every SharePoint web application.
• Use Request Body Scan Full Mode where feasible.
• Remove direct internet exposure.
• Place SharePoint behind authenticated Layer 7 reverse proxy/WAF.
• Block external Central Administration access.
• Restrict farm/database communications.
• Review service accounts, farm admins, timer jobs, scheduled tasks, and farm solutions.
• Plan migration away from unsupported SharePoint 2016/2019 where applicable.

🔎 High-Value Detection Ideas

Web / IIS / WAF

POST /_trust/default.aspx
AND request contains any of:
  SecurityContextToken
  BinaryFormatter
  AAEAAAD

Endpoint / EDR

Parent process: w3wp.exe
Child process: cmd.exe, powershell.exe, pwsh.exe, certutil.exe, bitsadmin.exe,
               mshta.exe, rundll32.exe, regsvr32.exe, cscript.exe, wscript.exe

File Integrity

Monitor:
C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\
C:\inetpub\wwwroot\wss\VirtualDirectories\

Alert on new or modified:
*.aspx, *.ashx, *.asmx, *.dll, web.config

Microsoft Defender / AMSI Detections From CISA Guidance

Exploit:Script/SuspSignoutReqBody.A
Exploit:Script/ToolPaneAuthBypass.A
Exploit:Script/ToolPaneAuthBypass.C
Backdoor:MSIL/LeakFang.A!dha

📊 Risk Matrix

✅ Verified Indicators and Gaps

📚 Full Report

The detailed analyst report is available in this repository:

➡️ CVE-2026-50522_CTI_Report.md

It includes:

• Official CVE details
• CPE validation
• Root-cause analysis
• Exploit maturity assessment
• Threat intelligence findings
• IOC table
• MITRE ATT&CK mapping
• Sigma ideas
• Wazuh guidance
• Splunk SPL
• Microsoft Sentinel KQL
• Snort/Suricata signatures
• Risk assessment
• Mitigation playbook
• Evidence provenance table
• Assumptions and limitations

🔗 Primary References

• Microsoft Security Update Guide: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-50522
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50522
• CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50522
• ZDI-26-412: https://www.zerodayinitiative.com/advisories/ZDI-26-412/
• NHS England Alert: https://digital.nhs.uk/cyber-alerts/2026/cc-4818
• BleepingComputer: https://www.bleepingcomputer.com/news/security/critical-sharepoint-rce-flaw-exploited-to-steal-machine-keys/
• Censys Advisory: https://censys.com/advisory/cve-2026-50522-cve-2026-58644/