Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC

Microsoft SharePoint is currently facing an active security crisis centered on a critical remote code execution vulnerability identified as CVE-2026-50522. According to reports from The Hacker News and CyberSecurityNews, this flaw is being exploited in the wild following the release of a public proof-of-concept. The technical nature of the attack allows for a single malicious web request to transform an exposed SharePoint server into a persistent backdoor. This capability enables attackers to move from an initial web request to a full domain compromise, as detailed in analysis provided by Resecurity. The vulnerability is facilitating the deployment of web shells and the theft of critical machine keys. Multiple industry outlets are tracking the escalation of these attacks.

BleepingComputer and SC Media emphasize that the exploit is specifically being used to steal machine keys, noting that this represents the fourth recent exploit of its kind. CyberSecurityNews further highlights the multifaceted nature of the threat, which includes remote code execution and the installation of web shells. Coverage from The National CIO Review links these SharePoint vulnerabilities with Windmill vulnerabilities, suggesting that both are fueling a fresh wave of enterprise-level attacks. Other regional and specialized reports, including those from Kaseya, have listed these events within their weekly breach news summaries for the period of July 15, 2026. Understanding the context of this trend requires noting the speed at which the public proof-of-concept transitioned into active exploitation. The vulnerability is categorized as critical because it grants attackers high-level access to servers via basic web requests.

As gbhackers.com points out, the ability to establish a persistent backdoor means that once a server is breached, the attackers can maintain access even after some initial remediation efforts. The focus on IIS key theft suggests that attackers are targeting the underlying infrastructure of the server to deepen their penetration into the corporate network, moving beyond the application layer to the domain level. Looking ahead, the primary focus for enterprise security teams is the mitigation of CVE-2026-50522 to prevent further domain compromises. Organizations are monitoring for signs of web shells and the unauthorized extraction of machine keys, as these are the primary indicators of a successful breach. Because the vulnerability is being actively exploited in the wild, the priority remains identifying exposed SharePoint servers that may have already been targeted by the malicious web requests described in the coverage. Future reports will likely track whether the exploitation of this flaw continues to rise in tandem with the Windmill vulnerabilities mentioned by The National CIO Review.