{"id":65475,"date":"2026-07-28T13:50:20","date_gmt":"2026-07-28T20:50:20","guid":{"rendered":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/"},"modified":"2026-07-28T13:50:20","modified_gmt":"2026-07-28T20:50:20","slug":"cve-2026-50522-sharepoint-rce-detection-with-sn1per","status":"publish","type":"post","link":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/","title":{"rendered":"CVE-2026-50522: Unauthenticated Deserialization RCE in Microsoft SharePoint Server &#8211; Advisory + Nuclei Detection"},"content":{"rendered":"<p>In its July 2026 Patch Tuesday, Microsoft shipped an emergency-grade fix for <strong>CVE-2026-50522<\/strong>, a critical, unauthenticated remote code execution vulnerability in on-premises <strong>Microsoft SharePoint Server<\/strong>. Within days the reason to act became undeniable: a working proof-of-concept went public, attackers began exploiting it in the wild, and CISA added it to the Known Exploited Vulnerabilities catalog with a federal patch deadline. Two facts make this one a drop-everything item: it needs <em>no authentication<\/em>, and the payoff is not just code execution &#8211; attackers are pulling ASP.NET machine keys in a single request, which lets them forge authentication tokens that survive patching.<\/p>\n<p>This advisory is three things at once. First, a plain-English explanation of what CVE-2026-50522 is, who is affected, and why patching alone is not enough. Second, a ready-to-run <strong>Nuclei detection template<\/strong> you can copy, paste, and scan with today &#8211; the same non-destructive template shipped in <a href=\"\/wordpress\/sn1per-professional-2026\/\">Sn1per<\/a>&#8216;s curated set. Third, a walkthrough of how to find every exposed SharePoint server across an attack surface and flag the ones still on a vulnerable build. Credit where it is due: CVE-2026-50522 was reported to Microsoft by DEVCORE researcher &ldquo;splitline&rdquo; and demonstrated live at Pwn2Own Berlin (ZDI-26-412); the public proof-of-concept and in-the-wild activity followed the July disclosure.<\/p>\n<h2 id=\"at-a-glance\">CVE-2026-50522 at a glance<\/h2>\n<ul>\n<li><strong>CVE:<\/strong> CVE-2026-50522 &#8211; insecure deserialization of untrusted data (CWE-502) in Microsoft SharePoint Server.<\/li>\n<li><strong>Impact:<\/strong> unauthenticated, pre-auth remote code execution as the SharePoint service account, followed by machine-key theft for persistence.<\/li>\n<li><strong>CVSS:<\/strong> 9.8 Critical (<code>CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H<\/code>). Microsoft tagged it &ldquo;Exploitation More Likely.&rdquo;<\/li>\n<li><strong>Affected:<\/strong> all supported on-premises editions &#8211; Enterprise Server 2016, Server 2019, and Subscription Edition. SharePoint Online (Microsoft 365) is not affected.<\/li>\n<li><strong>Fixed:<\/strong> the July 2026 security updates &#8211; build 16.0.5561.1001 (2016), 16.0.10417.20175 (2019), 16.0.19725.20434 (Subscription Edition) or later.<\/li>\n<li><strong>Status:<\/strong> public PoC, active in-the-wild exploitation, and CISA KEV as of July 22, 2026 (FCEB remediation due July 25).<\/li>\n<li><strong>Fix now:<\/strong> patch to a fixed build, then <strong>rotate ASP.NET machine keys<\/strong> &#8211; a patch alone does not evict an attacker who already has your keys.<\/li>\n<\/ul>\n<h2 id=\"what-is-cve-2026-50522\">What is CVE-2026-50522?<\/h2>\n<p>CVE-2026-50522 is an insecure-deserialization flaw (CWE-502) in the way SharePoint Server processes authentication tokens. Under the hood, SharePoint uses Windows Identity Foundation &#8211; the .NET framework for reading and writing security tokens &#8211; and its <code>SessionSecurityTokenHandler<\/code> reconstructs a <code>SessionSecurityToken<\/code> from data supplied in a sign-in request. The vulnerable code path deserializes that attacker-controlled data with the legacy <strong>BinaryFormatter<\/strong> before any application-level validation runs.<\/p>\n<p>BinaryFormatter is the crux of the risk. It has been recognized for years as a dangerous serializer because reconstructing an object graph can invoke methods on attacker-chosen types before your code ever inspects the result. Microsoft has discouraged its use for exactly this reason, and a long line of critical enterprise RCEs has come from feeding it untrusted bytes. Here, the untrusted bytes arrive as a forged security token, and the object graph is a gadget chain that ends in command execution.<\/p>\n<p>The delivery vehicle is <strong>WS-Federation<\/strong>. SharePoint exposes a trust sign-in endpoint at <code>\/_trust\/default.aspx<\/code> that accepts a <code>wsignin1.0<\/code> sign-in response. An unauthenticated attacker crafts a <code>RequestSecurityTokenResponse<\/code> that wraps a malicious <code>SecurityContextToken<\/code>; the serialized .NET gadget rides inside the token as a <code>&lt;Cookie&gt;<\/code> value. When SharePoint deserializes that token, the gadget fires and executes code inside the IIS worker process (<code>w3wp.exe<\/code>) under the SharePoint service account. No login, no user interaction, no phishing &#8211; a single crafted POST.<\/p>\n<p>One point worth flagging honestly for triage: <strong>Microsoft&#8217;s own advisory contradicts itself on whether authentication is required.<\/strong> The MSRC advisory prose says an attacker &ldquo;authenticated as at least a Site Owner&rdquo; could execute code, yet Microsoft&#8217;s own published CVSS vector for the same CVE is <code>PR:N<\/code> (no privileges required), and NVD reproduces that vector. The independent evidence sides with unauthenticated: the flaw was reported through Pwn2Own \/ ZDI (ZDI-26-412) as an unauthenticated bug, and captured in-the-wild requests carry no authentication material (the Site-Owner language may in fact belong to the paired CVE-2026-58644). When the vendor disagrees with itself, defend for the worse case &#8211; treat it as reachable pre-authentication and prioritize accordingly &#8211; while confirming the exact privilege requirement against Microsoft&#8217;s advisory for your environment.<\/p>\n<p>What turns a serious RCE into an emergency is the post-exploitation goal. Rather than stopping at a shell, attackers use CVE-2026-50522 to read the server&#8217;s ASP.NET <strong>machine keys<\/strong> &#8211; the cryptographic material SharePoint uses to sign and protect authentication data &#8211; in as little as one request. With those keys, an attacker can forge valid authentication tokens at will, impersonate users, and walk back in <em>after<\/em> the box is patched. This is the same playbook seen in the 2025 SharePoint &ldquo;ToolShell&rdquo; wave, and it is why every credible advisory says the same thing: patch, then rotate machine keys.<\/p>\n<h2 id=\"affected-versions\">Affected and fixed versions<\/h2>\n<p>CVE-2026-50522 affects every supported on-premises SharePoint Server edition. The cloud-hosted SharePoint Online is a separate, continuously updated codebase and is not in scope. The practical breakdown, by product line and build number, is below. SharePoint advertises a build in the <code>MicrosoftSharePointTeamServices<\/code> response header as <code>16.0.0.&lt;build&gt;<\/code>, so the fourth number is the one to compare.<\/p>\n<table>\n<thead>\n<tr>\n<th>SharePoint edition<\/th>\n<th>Affected builds<\/th>\n<th>Fixed build (July 2026)<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Enterprise Server 2016<\/strong><\/td>\n<td>Below 16.0.5561.1001<\/td>\n<td>16.0.5561.1001<\/td>\n<\/tr>\n<tr>\n<td><strong>Server 2019<\/strong><\/td>\n<td>Below 16.0.10417.20175<\/td>\n<td>16.0.10417.20175<\/td>\n<\/tr>\n<tr>\n<td><strong>Subscription Edition<\/strong><\/td>\n<td>Below 16.0.19725.20434<\/td>\n<td>16.0.19725.20434<\/td>\n<\/tr>\n<tr>\n<td>SharePoint Online (M365)<\/td>\n<td>Not affected<\/td>\n<td>N\/A<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The takeaway: if a farm&#8217;s running build is <em>below<\/em> the fixed build for its line, treat it as vulnerable and patch immediately. One caveat that trips people up during audits &#8211; a security update approved in WSUS or Configuration Manager is not the same as installed. The only build that counts is the one actually running on each server in the farm, which you can read with <code>(Get-SPFarm).BuildVersion<\/code> in the SharePoint Management Shell.<\/p>\n<h2 id=\"how-it-works\">How the exploit chain works<\/h2>\n<p>The attack is a single unauthenticated HTTP POST to the WS-Federation trust endpoint. The request looks ordinary &#8211; it is a standard <code>wsignin1.0<\/code> sign-in response &#8211; but the token it carries is malicious. In skeleton form, and with the weaponized payload deliberately redacted, the request is shaped like this:<\/p>\n<pre><code>POST \/_trust\/default.aspx HTTP\/1.1\nHost: sharepoint.example.com\nContent-Type: application\/x-www-form-urlencoded\n\nwa=wsignin1.0&amp;wctx=https:\/\/sharepoint.example.com\/&amp;wresult=\n  &lt;RequestSecurityTokenResponse ...&gt;\n    &lt;RequestedSecurityToken&gt;\n      &lt;SecurityContextToken ...&gt;\n        &lt;Cookie ...&gt;[BASE64 SERIALIZED .NET GADGET - REDACTED]&lt;\/Cookie&gt;\n      &lt;\/SecurityContextToken&gt;\n    &lt;\/RequestedSecurityToken&gt;\n  &lt;\/RequestSecurityTokenResponse&gt;<\/code><\/pre>\n<p>Inside that redacted blob is a serialized .NET BinaryFormatter payload. Public proof-of-concept code assembles it with a standard tool such as <code>ysoserial.net<\/code> (a common gadget chain here is <code>TypeConfuseDelegate<\/code>), DEFLATE-compresses the raw bytes, and Base64-encodes them to fit the cookie field, then wraps the result in the <code>SecurityContextToken<\/code> shown above. When SharePoint&#8217;s <code>SessionSecurityTokenHandler<\/code> deserializes the cookie, the gadget chain executes the attacker&#8217;s command in <code>w3wp.exe<\/code>. Public PoCs confirm the primitive by having the injected command call out to an attacker-controlled out-of-band server, so a callback is proof of code execution.<\/p>\n<p>We are deliberately <em>not<\/em> publishing a working exploit here. What follows is detection only &#8211; version fingerprinting that tells you whether a given SharePoint server sits below a fixed build, so you can prioritize patching. That is the responsible half, and for defenders it is the useful half. It is the same approach we took in our earlier advisories, such as <a href=\"\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/\">wp2shell (CVE-2026-63030)<\/a> and <a href=\"\/wordpress\/cve-2024-21733-apache-tomcat-http-request-smuggling\/\">CVE-2024-21733 (Apache Tomcat request smuggling)<\/a>: explain the flaw, then ship a safe detection you can run at scale.<\/p>\n<h2 id=\"quick-checks\">Am I affected? Quick manual checks<\/h2>\n<p>On a host you control, the authoritative check is the SharePoint Management Shell, run on a farm server:<\/p>\n<pre><code># Authoritative: ask the farm directly\n(Get-SPFarm).BuildVersion\n# At-risk if the build is below your line's fix:\n#   2016 &lt; 16.0.5561.1001 | 2019 &lt; 16.0.10417.20175 | SE &lt; 16.0.19725.20434<\/code><\/pre>\n<p>From the outside, SharePoint advertises a build in a response header. Any authenticated or anonymous page that returns the header is enough to fingerprint the line:<\/p>\n<pre><code># The build appears in the MicrosoftSharePointTeamServices header as 16.0.0.&lt;build&gt;\ncurl -sk -D - https:\/\/sharepoint.example.com\/ -o \/dev\/null | grep -i MicrosoftSharePointTeamServices\n\n# Some farms also expose it via the FrontPage service file:\ncurl -sk https:\/\/sharepoint.example.com\/_vti_pvt\/service.cnf | grep -i vti_extenderversion<\/code><\/pre>\n<p>One caveat that matters for accuracy: the <code>MicrosoftSharePointTeamServices<\/code> header reports a <em>minimum<\/em> build level and can lag the farm&#8217;s true patch state, because of how the value is written back during administrative operations. Treat an in-range header as &ldquo;confirm this,&rdquo; not a final verdict, and verify with <code>(Get-SPFarm).BuildVersion<\/code> on the host. It never over-reports the risk in a way that would make you skip patching, which is the safe direction for a triage signal.<\/p>\n<h2 id=\"nuclei-template\">Nuclei detection template for CVE-2026-50522<\/h2>\n<p>To check one server or ten thousand, a version-based Nuclei template is the fastest path. The template below &#8211; the same one shipped in Sn1per&#8217;s curated template set &#8211; passively fingerprints the SharePoint build from the <code>MicrosoftSharePointTeamServices<\/code> response header and flags any farm whose build falls below the July 2026 fix for its product line, using Nuclei&#8217;s <code>compare_versions<\/code> DSL. It sends no deserialization payload and never touches <code>\/_trust\/default.aspx<\/code>; it only reads a version header, so it is safe to run against production.<\/p>\n<pre><code>id: CVE-2026-50522\n\ninfo:\n  name: Microsoft SharePoint Server - Unauthenticated Deserialization RCE (CVE-2026-50522)\n  author: xer0dayz\n  severity: critical\n  description: |\n    Microsoft SharePoint Server (on-premises) is affected by CVE-2026-50522, a\n    pre-authentication remote code execution vulnerability caused by insecure\n    BinaryFormatter deserialization of untrusted data (CWE-502) in the Windows\n    Identity Foundation SessionSecurityTokenHandler. An unauthenticated attacker\n    POSTs a forged WS-Federation sign-in response (wa=wsignin1.0) to\n    \/_trust\/default.aspx whose SecurityContextToken cookie carries a serialized\n    .NET gadget chain; SharePoint deserializes it and executes code in the IIS\n    worker process (w3wp.exe) under the SharePoint service account. This template\n    is NON-DESTRUCTIVE: it detects on-premises SharePoint from the\n    MicrosoftSharePointTeamServices response header, extracts the advertised build,\n    and flags builds below the July 2026 fixed levels per product line (Enterprise\n    Server 2016 &lt; 16.0.5561.1001, Server 2019 &lt; 16.0.10417.20175, Subscription\n    Edition &lt; 16.0.19725.20434). It sends no deserialization payload.\n  remediation: |\n    Install the July 2026 SharePoint security updates so the running farm build\n    meets or exceeds 16.0.5561.1001 (2016), 16.0.10417.20175 (2019), or\n    16.0.19725.20434 (Subscription Edition). A build approved in WSUS is NOT\n    installed - verify with (Get-SPFarm).BuildVersion. Because attackers steal\n    ASP.NET machine keys for persistence, ROTATE machine keys after patching.\n  reference:\n    - https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2026-50522\n    - https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-50522\n    - https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog\n  classification:\n    cvss-metrics: CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-50522\n    cwe-id: CWE-502\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: microsoft\n    product: sharepoint_server\n    shodan-query: http.component:\"Microsoft SharePoint\"\n  tags: cve,cve2026,sharepoint,microsoft,rce,deserialization,unauth,kev,pwn2own\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\/\"\n      - \"{{BaseURL}}\/_layouts\/15\/start.aspx\"\n\n    stop-at-first-match: true\n    redirects: true\n    max-redirects: 2\n\n    matchers-condition: or\n    matchers:\n      - type: dsl\n        name: sharepoint-2016-below-16.0.5561.1001\n        dsl:\n          - \"compare_versions(version, '&gt;= 16.0.0.4000', '&lt; 16.0.0.5561')\"\n\n      - type: dsl\n        name: sharepoint-2019-below-16.0.10417.20175\n        dsl:\n          - \"compare_versions(version, '&gt;= 16.0.0.10000', '&lt; 16.0.0.10417')\"\n\n      - type: dsl\n        name: sharepoint-subscription-edition-below-16.0.19725.20434\n        dsl:\n          - \"compare_versions(version, '&gt;= 16.0.0.14000', '&lt; 16.0.0.19725')\"\n\n    extractors:\n      - type: kval\n        name: version\n        internal: true\n        kval:\n          - MicrosoftSharePointTeamServices\n\n      - type: kval\n        name: sharepoint_build\n        kval:\n          - MicrosoftSharePointTeamServices<\/code><\/pre>\n<p>Save it as <code>CVE-2026-50522.yaml<\/code> and run it against a single target or a list of hosts:<\/p>\n<pre><code># Single target\nnuclei -t CVE-2026-50522.yaml -u https:\/\/sharepoint.example.com\/\n\n# A whole list of SharePoint hosts\nnuclei -t CVE-2026-50522.yaml -l sharepoint-hosts.txt\n\n# Example match against an affected Server 2019 farm (build 16.0.0.10337):\n[CVE-2026-50522] [http] [critical] https:\/\/sharepoint.example.com\/ [sharepoint-2019-below-16.0.10417.20175] [16.0.0.10337]<\/code><\/pre>\n<p>The named matcher tells you which product line and fix level matched (for example <code>sharepoint-2019-below-16.0.10417.20175<\/code>), and the extracted build appears in the results, so triage is immediate. Because the check is version-based, it has two blind spots. First, confirm an in-range hit with <code>(Get-SPFarm).BuildVersion<\/code>, since the header advertises a minimum build. Second, treat a no-match as inconclusive, not clean: if a reverse proxy, WAF, or hardened configuration strips the version header, the template has nothing to compare and stays silent, which means &ldquo;unknown, verify manually,&rdquo; not &ldquo;patched.&rdquo; For anyone who needs defensible coverage across an entire estate &#8211; including SharePoint servers nobody remembered they exposed &#8211; the next step up is Sn1per.<\/p>\n<h2 id=\"detection-at-scale\">Detecting CVE-2026-50522 across your attack surface with Sn1per<\/h2>\n<p>One template against one URL is fine for a spot check. The real problem is scale and discovery: most organizations do not have a clean list of every SharePoint server they expose. An extranet collaboration site, a forgotten project farm, a subsidiary&#8217;s on-prem SharePoint on an acquired domain &#8211; those are exactly the hosts that miss the patch cycle and quietly sit on a vulnerable build for weeks. Finding them is an <a href=\"\/wordpress\/external-attack-surface-management-with-sn1per\/\">attack-surface problem<\/a> before it is a scanning problem.<\/p>\n<p>Sn1per is built for that. It runs discovery and detection as one engine: it enumerates the surface (subdomains, live hosts, services, technologies), fingerprints what is running, and runs its curated Nuclei set &#8211; including this CVE-2026-50522 template &#8211; against everything it finds, into a persistent named workspace. Instead of &ldquo;scan this one URL,&rdquo; the workflow becomes &ldquo;discover every SharePoint we expose and flag the ones on a vulnerable build.&rdquo;<\/p>\n<pre><code># Discover the surface, then run web detections (incl. the CVE-2026-50522 template)\n# into a persistent workspace\nsniper -t example.com -m recon -w acme-sp\nsniper -t example.com -m web   -w acme-sp\n\n# Pull the affected-version findings back out via the JSON API (Sn1per Professional 2026)\ncurl -sk -H \"X-API-Key: $SN1PER_API_KEY\" \n  \"https:\/\/sn1per.local\/pro\/api.php?action=vulnerabilities&amp;workspace=acme-sp\" | jq '.'<\/code><\/pre>\n<p>Because Sn1per keeps results in workspaces, the same command from cron or a CI\/CD pipeline re-checks the surface on a schedule, so a newly discovered or freshly stood-up SharePoint farm gets fingerprinted within a run rather than at the next annual pentest &#8211; the model we cover in <a href=\"\/wordpress\/continuous-attack-surface-testing\/\">continuous attack surface testing<\/a> and <a href=\"\/wordpress\/automated-penetration-testing\/\">automated penetration testing<\/a>. Findings also feed Sn1per&#8217;s correlation layer, so a CVE-2026-50522 hit on a host that also exposes other weaknesses is ranked in context rather than as an isolated line item.<\/p>\n<p>And because Sn1per is self-hosted &#8211; it has run on-prem since 2015 and is Docker-first &#8211; the entire scan, including the target list of your unpatched SharePoint servers, never leaves your perimeter. For an offensive-security tool inventorying your own exposure, that <a href=\"\/wordpress\/best-on-prem-external-attack-surface-management-platform\/\">on-prem posture<\/a> is the point: a map of what you have not patched yet is precisely the data you do not want sitting in someone else&#8217;s cloud.<\/p>\n<h3 id=\"edition-comparison\">Which Sn1per edition fits<\/h3>\n<table>\n<thead>\n<tr>\n<th>Capability<\/th>\n<th>Community Edition<\/th>\n<th>Professional 2026<\/th>\n<th>Enterprise<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Curated Nuclei set incl. CVE-2026-50522 template<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Discovery + detection engine<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Scale<\/td>\n<td>Single operator<\/td>\n<td>Up to 150 assets, single operator<\/td>\n<td>Near-unlimited, multi-operator<\/td>\n<\/tr>\n<tr>\n<td>Web UI + scheduled scans<\/td>\n<td>No<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>JSON API + SIEM \/ ticketing export<\/td>\n<td>No<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Multi-workspace \/ multi-team<\/td>\n<td>No<\/td>\n<td>No<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Self-hosted \/ on-prem<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><a href=\"\/wordpress\/sn1per-community-edition\/\">Sn1per Community Edition<\/a> is free and open-source and ships the same detection engine, so a spot check across a handful of hosts costs nothing. <a href=\"\/wordpress\/sn1per-professional-2026\/\">Sn1per Professional 2026<\/a> adds the web UI, scheduled scans, and the JSON API for teams that want continuous coverage and findings routed into a SIEM or ticket queue; live pricing is on the <a href=\"\/wordpress\/shop\/\">shop<\/a>. <a href=\"\/wordpress\/sn1per-enterprise\/\">Sn1per Enterprise<\/a> scales to near-unlimited assets with multi-operator, multi-workspace management for MSSPs and large security teams (custom quote). If you are weighing the two paid tiers, our <a href=\"\/wordpress\/sn1per-professional-vs-sn1per-enterprise-a-comprehensive-comparison\/\">Professional vs Enterprise comparison<\/a> breaks it down.<\/p>\n<h2 id=\"remediation\">Remediation and mitigation<\/h2>\n<p><strong>1. Patch. This is the only real fix.<\/strong> Install the July 2026 SharePoint security update so each server&#8217;s running build meets or exceeds 16.0.5561.1001 (2016), 16.0.10417.20175 (2019), or 16.0.19725.20434 (Subscription Edition). Verify the installed build on every farm server with <code>(Get-SPFarm).BuildVersion<\/code> rather than assuming a WSUS approval landed.<\/p>\n<p><strong>2. Rotate ASP.NET machine keys. Patching alone is not enough.<\/strong> Because attackers pull machine keys in a single request and use them to forge tokens that outlive the patch, any farm that was internet-exposed during the window should have its machine keys rotated after patching. The order matters, and so does the cmdlet: <code>Set-SPMachineKey<\/code> is what <em>generates<\/em> a new key, while <code>Update-SPMachineKey<\/code> only <em>deploys<\/em> the key already in the config database &#8211; so running Update alone just re-propagates the key an attacker may already have. Generate, deploy, then reset IIS on every server so the worker processes load the new key:<\/p>\n<pre><code># After patching: GENERATE a new machine key, deploy it farm-wide, then reset IIS.\n# Set-SPMachineKey with no key arguments mints a random key; without -Local it\n# deploys to the whole farm. Update-SPMachineKey alone only re-deploys the existing key.\nSet-SPMachineKey    -WebApplication https:\/\/sharepoint.example.com\nUpdate-SPMachineKey -WebApplication https:\/\/sharepoint.example.com\n\n# On SharePoint Subscription Edition \/ newer builds you can instead use:\n#   Central Administration &gt; Monitoring &gt; Review job definitions\n#   &gt; \"Machine Key Rotation Job\" &gt; Run Now\n\n# Machine keys live in the IIS worker process (w3wp.exe), not the timer service,\n# so finish with iisreset on EVERY SharePoint server in the farm:\niisreset<\/code><\/pre>\n<p><strong>3. Reduce exposure and harden.<\/strong> Enable AMSI integration on SharePoint 2016 and 2019 so the platform can intercept malicious payloads, put the farm behind a reverse proxy or WAF that inspects the <code>\/_trust\/<\/code> path for serialized .NET payload patterns, and restrict external access to authentication endpoints that do not need to be internet-facing. These reduce risk but are not substitutes for patching and key rotation.<\/p>\n<p><strong>4. Hunt for prior compromise.<\/strong> Because exploitation predates many patch windows, assume nothing. Inspect IIS logs for POST requests to <code>\/_trust\/default.aspx<\/code> carrying WS-Federation sign-in responses from unexpected external sources, and watch for unusual child processes spawned by <code>w3wp.exe<\/code> on SharePoint hosts &#8211; deserialization RCE commonly launches command interpreters or scripting hosts from the IIS worker process. Treat any evidence of access as a machine-key compromise and rotate.<\/p>\n<h2 id=\"faq\">Frequently asked questions<\/h2>\n<p><strong>What is CVE-2026-50522?<\/strong> CVE-2026-50522 is a critical, unauthenticated remote code execution vulnerability in on-premises Microsoft SharePoint Server. It stems from insecure BinaryFormatter deserialization of untrusted data (CWE-502) in the Windows Identity Foundation token handler. An anonymous attacker POSTs a forged WS-Federation sign-in response to <code>\/_trust\/default.aspx<\/code>; SharePoint deserializes a malicious security token and executes attacker code as the SharePoint service account.<\/p>\n<p><strong>Which SharePoint versions are affected by CVE-2026-50522?<\/strong> All supported on-premises editions: Enterprise Server 2016 (below build 16.0.5561.1001), Server 2019 (below 16.0.10417.20175), and Subscription Edition (below 16.0.19725.20434). SharePoint Online in Microsoft 365 is not affected. Install the July 2026 security update to reach a fixed build.<\/p>\n<p><strong>Is CVE-2026-50522 being exploited in the wild?<\/strong> Yes. A public proof-of-concept was released in July 2026 and active in-the-wild exploitation followed within days. CISA added CVE-2026-50522 to its Known Exploited Vulnerabilities catalog on July 22, 2026, with a federal remediation deadline of July 25. Attackers are using it to steal ASP.NET machine keys for persistence.<\/p>\n<p><strong>Why do I need to rotate machine keys after patching CVE-2026-50522?<\/strong> Because the vulnerability lets an attacker read the server&#8217;s ASP.NET machine keys, which sign and protect authentication tokens. An attacker who captured those keys before you patched can forge valid tokens and regain access even after the update is installed. Patching closes the door; rotating machine keys changes the locks.<\/p>\n<p><strong>Is the CVE-2026-50522 Nuclei template safe to run in production?<\/strong> Yes. The template only reads the public <code>MicrosoftSharePointTeamServices<\/code> response header and compares the advertised build against the fixed builds. It sends no deserialization payload and never touches <code>\/_trust\/default.aspx<\/code>, so it is safe to run against production targets. Confirm any in-range hit against the farm&#8217;s actual build with <code>(Get-SPFarm).BuildVersion<\/code>.<\/p>\n<p>CVE-2026-50522 is the kind of vulnerability that punishes incomplete inventory and slow key rotation more than slow patching alone: the servers that stay compromised are the ones nobody remembered they had, and the ones that got patched but never had their keys rotated. Patch what you know about today, rotate keys where exposure is possible, then use the template above &#8211; or <a href=\"\/wordpress\/sn1per-community-edition\/\">Sn1per<\/a> across your whole surface &#8211; to find the SharePoint you forgot.<\/p>\n<p><script type=\"application\/ld+json\">\n{\"@context\":\"https:\/\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[\n{\"@type\":\"Question\",\"name\":\"What is CVE-2026-50522?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"CVE-2026-50522 is a critical, unauthenticated remote code execution vulnerability in on-premises Microsoft SharePoint Server. It stems from insecure BinaryFormatter deserialization of untrusted data (CWE-502) in the Windows Identity Foundation token handler. An anonymous attacker POSTs a forged WS-Federation sign-in response to \/_trust\/default.aspx; SharePoint deserializes a malicious security token and executes attacker code as the SharePoint service account.\"}},\n{\"@type\":\"Question\",\"name\":\"Which SharePoint versions are affected by CVE-2026-50522?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"All supported on-premises editions: Enterprise Server 2016 below build 16.0.5561.1001, Server 2019 below 16.0.10417.20175, and Subscription Edition below 16.0.19725.20434. SharePoint Online in Microsoft 365 is not affected. Install the July 2026 security update to reach a fixed build.\"}},\n{\"@type\":\"Question\",\"name\":\"Is CVE-2026-50522 being exploited in the wild?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes. A public proof-of-concept was released in July 2026 and active in-the-wild exploitation followed within days. CISA added CVE-2026-50522 to its Known Exploited Vulnerabilities catalog on July 22, 2026, with a federal remediation deadline of July 25. Attackers are using it to steal ASP.NET machine keys for persistence.\"}},\n{\"@type\":\"Question\",\"name\":\"Why do I need to rotate machine keys after patching CVE-2026-50522?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Because the vulnerability lets an attacker read the server's ASP.NET machine keys, which sign and protect authentication tokens. An attacker who captured those keys before you patched can forge valid tokens and regain access even after the update is installed. Patching closes the door; rotating machine keys changes the locks.\"}},\n{\"@type\":\"Question\",\"name\":\"Is the CVE-2026-50522 Nuclei template safe to run in production?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes. The template only reads the public MicrosoftSharePointTeamServices response header and compares the advertised build against the fixed builds. It sends no deserialization payload and never touches \/_trust\/default.aspx, so it is safe to run against production targets. Confirm any in-range hit against the farm's actual build with (Get-SPFarm).BuildVersion.\"}}\n]}\n<\/script><\/p>\n<div id=\"wp-share-button-65475\" class=\"wp-share-button theme28\"><span class=\"total-share \"><i class=\"total-count-text\">Total Share<\/i> <i class=\"total-count\">0<\/i> <\/span><a target=\"_blank\" href=\"https:\/\/www.facebook.com\/sharer\/sharer.php?u=https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/\" class=\"share-button share-button-65475 facebook\" id=\"facebook\" data-nonce=\"da3d461f18\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Facebook<\/span>\r\n\r\n<span class=\"button-count\">0<\/span>\r\n\r\n<\/a>\r\n\r\n<a target=\"_blank\" href=\"https:\/\/twitter.com\/intent\/tweet?url=https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/&amp;text=CVE-2026-50522:%20Unauthenticated%20Deserialization%20RCE%20in%20Microsoft%20SharePoint%20Server%20\u2013%20Advisory%20+%20Nuclei%20Detection\" class=\"share-button share-button-65475 twitter\" id=\"twitter\" data-nonce=\"da3d461f18\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Twitter<\/span>\r\n\r\n<span class=\"button-count\">0<\/span>\r\n\r\n<\/a>\r\n\r\n<a target=\"_blank\" href=\"http:\/\/www.reddit.com\/submit?title=CVE-2026-50522:%20Unauthenticated%20Deserialization%20RCE%20in%20Microsoft%20SharePoint%20Server%20\u2013%20Advisory%20+%20Nuclei%20Detection&amp;url=https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/\" class=\"share-button share-button-65475 reddit\" id=\"reddit\" data-nonce=\"da3d461f18\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Reddit<\/span>\r\n\r\n<span class=\"button-count\">0<\/span>\r\n\r\n<\/a>\r\n\r\n<a target=\"_blank\" href=\"https:\/\/www.linkedin.com\/shareArticle?url=https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/&amp;title=CVE-2026-50522:%20Unauthenticated%20Deserialization%20RCE%20in%20Microsoft%20SharePoint%20Server%20\u2013%20Advisory%20+%20Nuclei%20Detection&amp;summary=&amp;source=\" class=\"share-button share-button-65475 linkedin\" id=\"linkedin\" data-nonce=\"da3d461f18\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Linkedin<\/span>\r\n\r\n<span class=\"button-count\">0<\/span>\r\n\r\n<\/a>\r\n\r\n<a title=\"More...\" href=\"#wp-share-button-65475\" class=\"share-button-more\"><span class=\"button-icon\"><i class=\"fa fa-plus\"><\/i><\/span><\/a><div class=\"wp-share-button-popup wp-share-button-popup-65475\"><div class=\"popup-buttons\"><span class=\"close\">X<\/span><a target=\"_blank\" href=\"mailto:?subject=CVE-2026-50522:%20Unauthenticated%20Deserialization%20RCE%20in%20Microsoft%20SharePoint%20Server%20\u2013%20Advisory%20+%20Nuclei%20Detection&amp;body=https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/\" class=\"share-button share-button-65475 email\" id=\"email\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Email<\/span>\r\n<span class=\"button-count\">0<\/span>\t\t\t\t\r\n\r\n<\/a>\r\n<\/div><\/div><\/div>","protected":false},"excerpt":{"rendered":"<p>CVE-2026-50522 is a critical, actively-exploited unauthenticated RCE in on-prem Microsoft SharePoint Server (2016, 2019, Subscription Edition). A plain-English advisory, a ready-to-run non-destructive Nuclei detection template, remediation with machine-key rotation, and how to detect vulnerable SharePoint at scale with Sn1per.<\/p>\n","protected":false},"author":1,"featured_media":65476,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[290,80,99,184,289,338,335],"tags":[359,448,50,452,437,453,451,449,454,450,37,366,436],"class_list":["post-65475","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-attack-surface-management","category-bug-bounties","category-cves","category-news","category-penetration-testing","category-threat-intelligence","category-vulnerability-scanning","tag-359","tag-cve-2026-50522","tag-deserialization","tag-machine-key-theft","tag-nuclei-template","tag-pwn2own","tag-sharepoint-deserialization","tag-sharepoint-rce","tag-sharepoint-security","tag-sharepoint-vulnerability","tag-sn1per","tag-sn1per-pro","tag-unauthenticated-rce"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"CVE-2026-50522: critical unauthenticated RCE in on-prem SharePoint Server (2016\/2019\/SE). Get the Nuclei detection template and scan at scale with Sn1per.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"xer0dayz\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Sn1perSecurity\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"CVE-2026-50522: SharePoint RCE Detection | Sn1per\" \/>\n\t\t<meta property=\"og:description\" content=\"CVE-2026-50522: critical unauthenticated RCE in on-prem SharePoint Server (2016\/2019\/SE). Get the Nuclei detection template and scan at scale with Sn1per.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-50522-sharepoint.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-50522-sharepoint.png\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-07-28T20:50:20+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-07-28T20:50:20+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Sn1persecurity-105784611869093\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@sn1persecurity\" \/>\n\t\t<meta name=\"twitter:title\" content=\"CVE-2026-50522: SharePoint RCE Detection | Sn1per\" \/>\n\t\t<meta name=\"twitter:description\" content=\"CVE-2026-50522: critical unauthenticated RCE in on-prem SharePoint Server (2016\/2019\/SE). Get the Nuclei detection template and scan at scale with Sn1per.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@sn1persecurity\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-50522-sharepoint.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\\\/#blogposting\",\"name\":\"CVE-2026-50522: SharePoint RCE Detection | Sn1per\",\"headline\":\"CVE-2026-50522: Unauthenticated Deserialization RCE in Microsoft SharePoint Server &#8211; Advisory + Nuclei Detection\",\"author\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/cve-2026-50522-sharepoint.png\",\"width\":1200,\"height\":630,\"caption\":\"Sn1perSecurity advisory cover: CVE-2026-50522 unauthenticated deserialization RCE in Microsoft SharePoint Server, with a Nuclei detection template and Sn1per attack surface detection\"},\"datePublished\":\"2026-07-28T13:50:20-07:00\",\"dateModified\":\"2026-07-28T13:50:20-07:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\\\/#webpage\"},\"articleSection\":\"Attack Surface Management, Bug Bounties, CVE's, News, Penetration Testing, Threat Intelligence, Vulnerability Scanning, 2026, cve-2026-50522, deserialization, machine-key-theft, nuclei-template, pwn2own, sharepoint-deserialization, sharepoint-rce, sharepoint-security, sharepoint-vulnerability, sn1per, sn1per pro, unauthenticated-rce\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/category\\\/bug-bounties\\\/#listItem\",\"name\":\"Bug Bounties\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/category\\\/bug-bounties\\\/#listItem\",\"position\":2,\"name\":\"Bug Bounties\",\"item\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/category\\\/bug-bounties\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\\\/#listItem\",\"name\":\"CVE-2026-50522: Unauthenticated Deserialization RCE in Microsoft SharePoint Server &#8211; Advisory + Nuclei Detection\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\\\/#listItem\",\"position\":3,\"name\":\"CVE-2026-50522: Unauthenticated Deserialization RCE in Microsoft SharePoint Server &#8211; Advisory + Nuclei Detection\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/category\\\/bug-bounties\\\/#listItem\",\"name\":\"Bug Bounties\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#organization\",\"name\":\"Sn1perSecurity\",\"description\":\"Get an attacker's view of your organization with our all-in-one offensive security platform\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/\",\"email\":\"support@sn1persecurity.com\",\"foundingDate\":\"2021-10-05\",\"numberOfEmployees\":{\"@type\":\"QuantitativeValue\",\"value\":2},\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/Sn1perwhiteandcircleicontwitter.jpg\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\\\/#organizationLogo\",\"width\":500,\"height\":500,\"caption\":\"Sn1perSecurity Logo\"},\"image\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/Sn1persecurity-105784611869093\",\"https:\\\/\\\/x.com\\\/sn1persecurity\",\"https:\\\/\\\/www.instagram.com\\\/sn1persecurity\",\"https:\\\/\\\/www.youtube.com\\\/sn1persecurity\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/sn1persecurity\\\/\",\"https:\\\/\\\/github.com\\\/1N3\\\/Sn1per\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/#author\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/\",\"name\":\"xer0dayz\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/60111840c4f5a576635c5b9169e7322cec38bea67f56f0c141021c7579f230a4?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"xer0dayz\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\\\/#webpage\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\\\/\",\"name\":\"CVE-2026-50522: SharePoint RCE Detection | Sn1per\",\"description\":\"CVE-2026-50522: critical unauthenticated RCE in on-prem SharePoint Server (2016\\\/2019\\\/SE). Get the Nuclei detection template and scan at scale with Sn1per.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/cve-2026-50522-sharepoint.png\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\\\/#mainImage\",\"width\":1200,\"height\":630,\"caption\":\"Sn1perSecurity advisory cover: CVE-2026-50522 unauthenticated deserialization RCE in Microsoft SharePoint Server, with a Nuclei detection template and Sn1per attack surface detection\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\\\/#mainImage\"},\"datePublished\":\"2026-07-28T13:50:20-07:00\",\"dateModified\":\"2026-07-28T13:50:20-07:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#website\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/\",\"name\":\"Sn1perSecurity\",\"alternateName\":\"Sn1per\",\"description\":\"Get an attacker's view of your organization with our all-in-one offensive security platform\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"CVE-2026-50522: SharePoint RCE Detection | Sn1per","description":"CVE-2026-50522: critical unauthenticated RCE in on-prem SharePoint Server (2016\/2019\/SE). Get the Nuclei detection template and scan at scale with Sn1per.","canonical_url":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/#blogposting","name":"CVE-2026-50522: SharePoint RCE Detection | Sn1per","headline":"CVE-2026-50522: Unauthenticated Deserialization RCE in Microsoft SharePoint Server &#8211; Advisory + Nuclei Detection","author":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/#author"},"publisher":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-50522-sharepoint.png","width":1200,"height":630,"caption":"Sn1perSecurity advisory cover: CVE-2026-50522 unauthenticated deserialization RCE in Microsoft SharePoint Server, with a Nuclei detection template and Sn1per attack surface detection"},"datePublished":"2026-07-28T13:50:20-07:00","dateModified":"2026-07-28T13:50:20-07:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/#webpage"},"isPartOf":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/#webpage"},"articleSection":"Attack Surface Management, Bug Bounties, CVE's, News, Penetration Testing, Threat Intelligence, Vulnerability Scanning, 2026, cve-2026-50522, deserialization, machine-key-theft, nuclei-template, pwn2own, sharepoint-deserialization, sharepoint-rce, sharepoint-security, sharepoint-vulnerability, sn1per, sn1per pro, unauthenticated-rce"},{"@type":"BreadcrumbList","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress#listItem","position":1,"name":"Home","item":"https:\/\/sn1persecurity.com\/wordpress","nextItem":{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/#listItem","name":"Bug Bounties"}},{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/#listItem","position":2,"name":"Bug Bounties","item":"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/","nextItem":{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/#listItem","name":"CVE-2026-50522: Unauthenticated Deserialization RCE in Microsoft SharePoint Server &#8211; Advisory + Nuclei Detection"},"previousItem":{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/#listItem","position":3,"name":"CVE-2026-50522: Unauthenticated Deserialization RCE in Microsoft SharePoint Server &#8211; Advisory + Nuclei Detection","previousItem":{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/#listItem","name":"Bug Bounties"}}]},{"@type":"Organization","@id":"https:\/\/sn1persecurity.com\/wordpress\/#organization","name":"Sn1perSecurity","description":"Get an attacker's view of your organization with our all-in-one offensive security platform","url":"https:\/\/sn1persecurity.com\/wordpress\/","email":"support@sn1persecurity.com","foundingDate":"2021-10-05","numberOfEmployees":{"@type":"QuantitativeValue","value":2},"logo":{"@type":"ImageObject","url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/06\/Sn1perwhiteandcircleicontwitter.jpg","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/#organizationLogo","width":500,"height":500,"caption":"Sn1perSecurity Logo"},"image":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/#organizationLogo"},"sameAs":["https:\/\/www.facebook.com\/Sn1persecurity-105784611869093","https:\/\/x.com\/sn1persecurity","https:\/\/www.instagram.com\/sn1persecurity","https:\/\/www.youtube.com\/sn1persecurity","https:\/\/www.linkedin.com\/in\/sn1persecurity\/","https:\/\/github.com\/1N3\/Sn1per"]},{"@type":"Person","@id":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/#author","url":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/","name":"xer0dayz","image":{"@type":"ImageObject","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/60111840c4f5a576635c5b9169e7322cec38bea67f56f0c141021c7579f230a4?s=96&d=mm&r=g","width":96,"height":96,"caption":"xer0dayz"}},{"@type":"WebPage","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/#webpage","url":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/","name":"CVE-2026-50522: SharePoint RCE Detection | Sn1per","description":"CVE-2026-50522: critical unauthenticated RCE in on-prem SharePoint Server (2016\/2019\/SE). Get the Nuclei detection template and scan at scale with Sn1per.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/#website"},"breadcrumb":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/#breadcrumblist"},"author":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/#author"},"creator":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-50522-sharepoint.png","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/#mainImage","width":1200,"height":630,"caption":"Sn1perSecurity advisory cover: CVE-2026-50522 unauthenticated deserialization RCE in Microsoft SharePoint Server, with a Nuclei detection template and Sn1per attack surface detection"},"primaryImageOfPage":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/#mainImage"},"datePublished":"2026-07-28T13:50:20-07:00","dateModified":"2026-07-28T13:50:20-07:00"},{"@type":"WebSite","@id":"https:\/\/sn1persecurity.com\/wordpress\/#website","url":"https:\/\/sn1persecurity.com\/wordpress\/","name":"Sn1perSecurity","alternateName":"Sn1per","description":"Get an attacker's view of your organization with our all-in-one offensive security platform","inLanguage":"en-US","publisher":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/#organization"}}]},"og:locale":"en_US","og:site_name":"Sn1perSecurity","og:type":"article","og:title":"CVE-2026-50522: SharePoint RCE Detection | Sn1per","og:description":"CVE-2026-50522: critical unauthenticated RCE in on-prem SharePoint Server (2016\/2019\/SE). Get the Nuclei detection template and scan at scale with Sn1per.","og:url":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/","og:image":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-50522-sharepoint.png","og:image:secure_url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-50522-sharepoint.png","og:image:width":"1200","og:image:height":"630","article:published_time":"2026-07-28T20:50:20+00:00","article:modified_time":"2026-07-28T20:50:20+00:00","article:publisher":"https:\/\/www.facebook.com\/Sn1persecurity-105784611869093","twitter:card":"summary_large_image","twitter:site":"@sn1persecurity","twitter:title":"CVE-2026-50522: SharePoint RCE Detection | Sn1per","twitter:description":"CVE-2026-50522: critical unauthenticated RCE in on-prem SharePoint Server (2016\/2019\/SE). Get the Nuclei detection template and scan at scale with Sn1per.","twitter:creator":"@sn1persecurity","twitter:image":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-50522-sharepoint.png"},"aioseo_meta_data":{"post_id":"65475","title":"CVE-2026-50522: SharePoint RCE Detection | Sn1per","description":"CVE-2026-50522: critical unauthenticated RCE in on-prem SharePoint Server (2016\/2019\/SE). Get the Nuclei detection template and scan at scale with Sn1per.","keywords":null,"keyphrases":{"focus":{"keyphrase":"CVE-2026-50522","score":0,"analysis":[]}},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"featured","og_image_url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-50522-sharepoint.png","og_image_width":"1200","og_image_height":"630","og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":true,"twitter_card":"summary_large_image","twitter_image_type":"featured","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":true,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2026-07-28 20:50:22","updated":"2026-07-28 20:50:23","seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/sn1persecurity.com\/wordpress\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/\" title=\"Bug Bounties\">Bug Bounties<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tCVE-2026-50522: Unauthenticated Deserialization RCE in Microsoft SharePoint Server \u2013 Advisory + Nuclei Detection\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/sn1persecurity.com\/wordpress"},{"label":"Bug Bounties","link":"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/"},{"label":"CVE-2026-50522: Unauthenticated Deserialization RCE in Microsoft SharePoint Server &#8211; Advisory + Nuclei Detection","link":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/"}],"jetpack_featured_media_url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-50522-sharepoint.png","jetpack_shortlink":"https:\/\/wp.me\/pdnW96-h23","jetpack_likes_enabled":true,"jetpack_sharing_enabled":true,"jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/posts\/65475","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/comments?post=65475"}],"version-history":[{"count":0,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/posts\/65475\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/media\/65476"}],"wp:attachment":[{"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/media?parent=65475"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/categories?post=65475"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/tags?post=65475"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}