Published on 28 July 2026
A single manipulated request from the internet is enough – and attackers gain not only control over your SharePoint server, but also the cryptographic keys that let them entrench themselves permanently. That is exactly what has been happening around the world since 20 July 2026. The critical vulnerability CVE-2026-50522 in Microsoft SharePoint Server is being actively exploited, and the most insidious part: simply applying the patch is not enough to make your system secure again.
If your company runs SharePoint as a locally operated version (on-premises) for intranet, document management or collaboration, you should read this article now and then act immediately. We explain what happened, how to check whether you are affected, and which steps are now absolutely essential.
On 14 July 2026, as part of its monthly "Patch Tuesday", Microsoft released a security update for a serious flaw in SharePoint Server. This vulnerability carries the identifier CVE-2026-50522 and the highest possible severity range: a CVSS score of 9.8 out of 10 (CVSS is the standardised rating scale for the danger posed by security vulnerabilities). It was discovered by the security researcher "splitline" of team DEVCORE and reported via the Trend Micro Zero Day Initiative as part of the Pwn2Own hacking competition.
At the time the patch was published, there was, according to Microsoft, no active exploitation yet. That changed abruptly: on 20 July 2026 a researcher named "Janggggg" published a so-called proof-of-concept (PoC) – a publicly available guide or sample code demonstrating how the flaw can be exploited in practice. Just a few hours later, the global honeypot network of the security firm watchTowr (honeypots are deliberately exposed decoy systems for attack detection) registered the first real attack attempts. In hindsight, the company Defused Cyber had already observed suspicious, unauthenticated requests on 17 July.
On 22 July 2026, the US cybersecurity agency CISA added the vulnerability to its KEV catalogue – the register of "Known Exploited Vulnerabilities", i.e. flaws that are demonstrably being actively exploited. US federal agencies were given a deadline of 25 July 2026 to apply the patch. A clear signal of the urgency.
CVE-2026-50522 is a so-called deserialisation vulnerability (technical term CWE-502: "Deserialization of Untrusted Data"). Put simply: deserialisation is the process by which a program converts received data packets back into usable objects. If untrusted data is processed unchecked in the process, an attacker can inject malicious commands.
The attack runs through a single crafted HTTP request command to the SharePoint endpoint /_trust/default.aspx. Into this request the attackers embed a forged security token with a malicious .NET payload. If the server processes this token, the result is Remote Code Execution (RCE) – the ability to run arbitrary program code on the server from afar.
The technical profile of the flaw (CVSS vector AV:N/AC:L/PR:N/UI:N) shows why it is so dangerous:
The truly dangerous part, however, follows after the actual breach: attackers can extract the IIS machine keys with a single request. These are cryptographic keys that ASP.NET applications (SharePoint's web framework) use to protect and validate authentication data. Whoever possesses these keys can forge valid login tokens, impersonate any user and – this is the decisive point – retain permanent access, even after the patch has been installed.
"Attackers are pulling SharePoint machine keys via a single request. Patching is not enough; defenders should rotate credentials on any assets that may have been exposed." – watchTowr, LinkedIn warning
watchTowr describes the damage potential as "ToolShell-class impact" – a reference to the devastating SharePoint attack wave of summer 2025 (CVE-2025-53770/53771), in which more than 400 organisations worldwide were compromised, including US federal agencies such as the Department of Energy.
Affected are exclusively on-premises versions of SharePoint Server, i.e. self-operated installations in your own data centre or on rented servers:
Important reassurance: If you use SharePoint Online as part of Microsoft 365, you are not affected. Microsoft patches the cloud version centrally and automatically.
According to an analysis by the security service provider Censys, around 1,500 self-managed on-premises instances are publicly reachable on the internet worldwide – predominantly SharePoint 2019. And particularly relevant for our readers: Germany is, after the USA, among the most exposed countries.
"Much of the exposed on-premises SharePoint population runs on cloud infrastructure, but responsibility for patching still rests with the customer." – Censys Rapid Response Advisory
Given the active exploitation, haste is required. Be sure to observe the order of the steps – particularly when handling the machine keys.
Microsoft itself emphasises the importance of key rotation:
"The security update fully mitigates the issue, however rotating machine keys can be performed to further safeguard user environments." – Microsoft company spokesperson to Cybersecurity Dive
For German companies that process personal data on their SharePoint server – such as employee, customer or partner data – this vulnerability is also highly relevant under data protection law. A successful attack constitutes a "personal data breach" within the meaning of Art. 4(12) GDPR, because attackers can gain unauthorised access and siphon off data.
Reporting obligation (Art. 33 GDPR): Such a data breach must be reported to the competent data protection supervisory authority as soon as possible, within 72 hours of becoming aware of it – depending on the federal state, for instance to the Bavarian State Office for Data Protection Supervision, the LDI NRW or the Hamburg Commissioner. In the case of an RCE attack with machine-key theft, the risk to those affected is to be classified as high, so the reporting obligation will as a rule apply.
Notification obligation (Art. 34 GDPR): Where a high risk is likely, for example if sensitive data has been exfiltrated, the affected individuals themselves must also be informed without delay.
Fine risk (Art. 83 GDPR): Failure to apply critical patches promptly can be treated as a breach of Art. 32 GDPR (security of processing). The range extends up to EUR 10 million or 2% of global annual turnover, and in serious cases up to EUR 20 million or 4%. For context: in Germany in 2025 a total of 249 fines with a volume of almost EUR 47 million were imposed – the maximum penalty of EUR 45 million hit Vodafone, among other things because of security shortcomings. Cooperating with the supervisory authority and proactively minimising the damage, on the other hand, has a positive effect (Art. 83(2) GDPR).
Our recommendation: keep an incident response plan ready that takes the 72-hour deadline into account, and document your technical and organisational measures regularly.
CVE-2026-50522 is a lesson in response speed: only a few hours lay between the publication of the proof-of-concept and the first real attacks. The CVSS score of 9.8, the absence of any authentication hurdle and, above all, the theft of the machine keys make this flaw particularly treacherous – because merely patching is not enough. Anyone already compromised could still have an invisible guest in the system even after the update.
The message is clear: if you run SharePoint on-premises, patch immediately, search for signs of a breach, then rotate the machine keys and change all potentially exposed credentials. Also check whether your server needs to be reachable from the internet at all. And if you internally lack the capacity for continuous patching and monitoring, a switch to SharePoint Online is a seriously worthwhile, permanently relieving alternative. With this flaw, Germany is among the countries with the largest attack surface – act before someone else does it for you.