Affected Systems
Microsoft SharePoint Server (specific versions not provided). Vulnerability enables remote code execution with machine key theft capability, allowing persistent access beyond patch deployment.
Exploitation Status
Active exploitation confirmed. Attackers are leveraging this vulnerability in the wild to steal machine keys and establish persistence mechanisms that survive patching.
Business Impact
Critical impact for organizations running SharePoint. Attackers can achieve remote code execution, exfiltrate machine keys (used for encryption/decryption of viewstate and forms authentication), and maintain backdoor access even after applying security patches. Compromised machine keys enable session hijacking, authentication bypass, and long-term persistence. Incident response teams must assume breach and hunt for indicators of compromise, not just patch.
Urgency
🔴 Immediate
Recommended Actions
- Apply Microsoft security patches for CVE-2026-50522 immediately to all SharePoint servers
- Rotate machine keys on all SharePoint servers after patching using Set-SPSecurityTokenServiceConfig and web.config updates
- Hunt for suspicious SharePoint activity: review IIS logs for unusual POST requests, check for webshells in SharePoint directories (_layouts, _app_bin), and examine outbound connections
- Monitor for authentication anomalies and session token reuse patterns in SharePoint authentication logs
- Isolate affected SharePoint servers from network if compromise indicators found; conduct full forensic analysis before restoration