SharePoint CVE-2026-50522 Is Already Being Exploited: Why a Patch Alone May Not Be Enough

Colleagues, I would like to draw your attention to a cybersecurity issue: CVE-2026-50522 in Microsoft SharePoint is already being actively exploited following the release of a PoC.

Key points:
• this is a critical RCE vulnerability with a CVSS score of 9.8;
• an attacker can achieve remote code execution;
• according to watchTowr, threat actors are extracting machine keys with a single request and maintaining access;
• Microsoft has already released a fix, but it may not be sufficient.

Why it matters: I would not stop at patching alone and would also verify potential compromise, as well as rotate keys and credentials on affected systems.

How do you assess the risk for on-prem SharePoint right now?

#cybersecurity #SharePoint #Microsoft #Vulnerability