CVE-2026-50522: SharePoint Deserialization Flaw Under Active Exploitation (CISA KEV)

What the Vulnerability Is

CVE-2026-50522 is a deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint. Crafted serialized payloads submitted to SharePoint application pages or web services are deserialized unsafely, allowing an attacker to achieve remote code execution in the context of the SharePoint application pool. Depending on the exposed endpoint, exploitation may require authentication or none at all.

Affected Software

• Vendor: Microsoft
• Product: SharePoint

Specific affected version ranges have not been published in this detection's source data; organizations should consult Microsoft's advisory for the CVE to confirm exposure.

Exploitation Status

CVE-2026-50522 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and is being actively exploited in the wild. This vulnerability was disclosed on 2026-07-22. Given active exploitation, defenders should treat internet-facing and internal SharePoint deployments as immediate priorities for detection and patching, rather than a theoretical or PoC-only risk.

How Our Detection Catches It

This detection ships across Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL), and focuses on the process and web-layer indicators typical of SharePoint deserialization abuse:

• Process ancestry: w3wp.exe running the SharePoint application pool spawning suspicious child processes (command shells, scripting interpreters, LOLBins).
• Web request anomalies: ViewState and serialized-object anomalies observed in IIS logs, indicative of tampered or malformed serialized payloads reaching application pages/web services.
• Filesystem indicators: writes to the ASP.NET temporary compilation directory consistent with webshell drop and subsequent execution.
• Post-exploitation execution: PowerShell or cmd.exe invocations originating from the SharePoint process tree, a strong signal of successful RCE following deserialization.

Correlating these signals — rather than alerting on any single indicator alone — reduces false positives while catching both pre-RCE exploitation attempts and post-exploitation activity.

Full Detection Details

For the complete detection logic, including the KQL, SPL, and other SIEM queries, visit the CVE-2026-50522 detection page.