Microsoft SharePoint Server faces active exploitation of CVE-2026-50522, a critical remote code execution vulnerability disclosed in July 2026. The flaw scores 9.8 on the CVSS scale, indicating severe risk across networks.

The vulnerability stems from insecure deserialization of untrusted data within SharePoint Server. An unauthenticated attacker can exploit this flaw to execute arbitrary code remotely without requiring valid credentials or user interaction. WatchTowr confirmed active exploitation in the wild following public release of a proof-of-concept exploit.

Microsoft patched CVE-2026-50522 as part of its July 2026 Patch Tuesday cycle. The company credited DEVCORE for responsible disclosure. This marks the third SharePoint Server vulnerability addressed in that same update, signaling a broader pattern of serialization flaws affecting the platform.

Organizations running unpatched SharePoint Server instances face immediate risk. Attackers can leverage this vulnerability to gain complete control over vulnerable servers, potentially compromising sensitive documents, user credentials, and internal communications. The lack of authentication requirements dramatically expands the attack surface, as threat actors can target SharePoint deployments from the internet.

Internet-facing SharePoint deployments represent the highest priority for remediation. Network segmentation and access controls provide limited protection given the network-accessible nature of the vulnerability. Organizations should treat this as a zero-day equivalent threat despite the available patch.

Mitigation requires immediate deployment of Microsoft's July 2026 security updates. Organizations unable to patch immediately should restrict network access to SharePoint servers and monitor for suspicious deserialization activity in logs. The combination of critical CVSS rating, active exploitation, and public PoC availability makes rapid patching non-negotiable.

This incident underscores persistent challenges with Java-based deserialization attacks across enterprise platforms. SharePoint administrators should prioritize