Attackers steal SharePoint machine keys in one request after exploit code goes public

Attackers began exploiting a critical Microsoft SharePoint flaw within days of a working proof-of-concept appearing publicly. CVE-2026-50522 is a deserialization of untrusted data issue rated 9.8 that lets a remote attacker run code on on-premises SharePoint without authentication, and Microsoft patched it in the July updates while marking exploitation as more likely rather than confirmed. Offensive security firm watchTowr reports active attacks against on-premises deployments, with attackers pulling SharePoint machine keys in a single request. Those keys let an attacker forge authentication tokens and impersonate users, so access survives patching. It is the third SharePoint flaw to see exploitation this month.

Check

Apply July's SharePoint updates, then rotate machine keys on any on-premises server that was internet-reachable, since patching alone does not evict an attacker who already pulled them.

Affected

Organizations running on-premises SharePoint Server 2016, 2019, or Subscription Edition (CVE-2026-50522); unauthenticated attackers run code and steal machine keys that let them forge tokens and keep access after patching.

Fix

Patch, rotate machine keys and any credentials the server handled, hunt for web shells and forged token use, and restrict internet exposure of on-premises SharePoint deployments.