Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-50522.
Upgrade to ProDetect Microsoft SharePoint Deserialization of Untrusted Data (CVE-2026-50522) in Sumo Logic CSE
Detects exploitation attempts and post-exploitation indicators of CVE-2026-50522, an unauthenticated/authenticated deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint that allows remote code execution via crafted serialized payloads submitted to SharePoint application pages or web services. This CVE is listed in CISA KEV and is being actively exploited in the wild. Detection focuses on w3wp.exe (SharePoint app pool) spawning suspicious child processes, ViewState/serialized-object anomalies in IIS logs, ASPNET compilation directory writes (dropped webshells), and PowerShell/cmd execution originating from the SharePoint process tree.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
Sumo Detection Query
_sourceCategory=windows/sysmon OR _sourceCategory=iis/logs
| where ParentImage matches "*w3wp.exe"
| where CommandLine matches "*SharePoint*" or ParentCommandLine matches "*SharePoint*"
| where Image matches "*cmd.exe*" or Image matches "*powershell.exe*" or Image matches "*cscript.exe*" or Image matches "*certutil.exe*"
| count by ComputerName, Image, CommandLine
| sort by _countDetects suspicious child process execution from the SharePoint w3wp.exe worker process consistent with CVE-2026-50522 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- SharePoint timer job automation
- Legitimate admin PowerShell scripts run under the app pool account
- Third-party monitoring tools attaching to the worker process
Other platforms for CVE-2026-50522
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate w3wp.exe spawning cmd.exe
Expected signal: Sysmon Event ID 1 showing cmd.exe with parent process w3wp.exe (or simulated parent)
- Test 2Drop simulated webshell file into LAYOUTS directory
Expected signal: Sysmon Event ID 11 file creation event for shell.aspx under a LAYOUTS-like path
- Test 3Simulate PowerShell execution from SharePoint worker context
Expected signal: Sysmon Event ID 1 for powershell.exe with -EncodedCommand argument
- Test 4Simulate outbound connection from SharePoint app pool process
Expected signal: Network connection event and Sysmon Event ID 3 originating from the simulated w3wp.exe process
References (6)
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-50522
- http://www.zerodayinitiative.com/advisories/ZDI-26-413/
- http://www.zerodayinitiative.com/advisories/ZDI-26-412/
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-50522 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month