Critical Remote Code Execution in Microsoft SharePoint (CVE‑2026‑50522) Enables Machine‑Key Theft
What It Is — A deserialization‑of‑untrusted‑data flaw in on‑premises Microsoft SharePoint allows an unauthenticated remote attacker to execute arbitrary code and steal the server’s machine‑key. The stolen key can be used to forge valid authentication tokens and impersonate users.
Exploitability — Public proof‑of‑concept code appeared on GitHub on July 20 2026; watchTowr’s honeypot network recorded exploitation attempts within hours. The vulnerability is rated Critical (CVSS ≈ 9.8) and is being actively leveraged in the wild.
Affected Products — Microsoft SharePoint Server (on‑premises) versions prior to the July 2026 security update.
Why It Matters for Compliance & Audit Readiness
- Access‑control integrity – Machine‑key compromise bypasses authentication controls, directly violating SOC 2 CC6.1 (Logical Access) and CC6.2 (User Access Management).
- Evidence of due diligence – Continuous monitoring of patch status and credential rotation provides audit‑ready proof that you remediate high‑severity flaws promptly.
- Defensible audit trail – Documenting key‑rotation and token‑validation activities satisfies the “change management” and “incident response” criteria auditors now scrutinize after high‑impact exploits.
Recommended Actions
- Apply the July 2026 SharePoint security update immediately on all on‑prem servers.
- Rotate all affected machine keys and any derived authentication tokens.
- Review and harden token‑issuance pipelines (e.g., WS‑Federation endpoints) and enforce strict deserialization controls.
- Enable continuous vulnerability scanning and integrate patch‑status data into your SOC 2 evidence repository.
- Log and alert on anomalous token‑creation events; retain logs for at least 12 months for audit purposes.
Source: BleepingComputer – Critical SharePoint RCE flaw exploited to steal machine keys