What is the CVSS score of CVE-2026-50522?

CVE-2026-50522 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 19.7%.

Which versions of Microsoft SharePoint are affected by CVE-2026-50522?

A critical remote code execution vulnerability (CVE-2026-50522) in Microsoft SharePoint Server 2016, 2019, and Subscription Edition allows unauthenticated attackers to execute code remotely over the…. A patch is available.

Is there a public PoC exploit available for CVE-2026-50522?

Yes, a public proof-of-concept exploit is available for CVE-2026-50522. Prioritise patching immediately. EPSS: 19.7%.

How to fix or mitigate CVE-2026-50522?

Within 24 hours, conduct a complete inventory of all SharePoint 2016, 2019, and Subscription Edition deployments, identify internet-exposed instances, and implement emergency network access controls to restrict external connectivity if the service is not operationally critical. Within 7 days, apply the vendor-released patch to all non-production SharePoint systems first to validate compatibility, then systematically patch all production instances prioritizing internet-facing and high-sensitivity data repositories. Within 30 days, complete patch deployment across all SharePoint infrastructure, audit access logs for exploitation attempts, and implement network segmentation to isolate patched SharePoint systems from critical business applications.

Microsoft SharePoint CVE-2026-50522

EUVD-2026-43767 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-07-14 microsoft

GHSA-ww8x-9jc5-9v7f

Deserialization Microsoft Microsoft Sharepoint Enterprise Server 2016 Microsoft Sharepoint Server 2019 Microsoft Sharepoint Server Subscription Edition

9.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable deserialization (AV:N/PR:N/UI:N/AC:L) yielding code execution in the SharePoint web app with full C/I/A impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Jul 22, 2026 - 20:02 CISA

Analysis Generated

Jul 14, 2026 - 18:17 vuln.today

CVE Published

Jul 14, 2026 - 17:05 nvd

CRITICAL 9.8

DescriptionCVE.org

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Articles & Coverage 1

POC CVE-2026-50522: Proof-of-Concept Repository (Details Pending) Jul 22, 2026

AnalysisAI

Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated attacker run arbitrary code by sending a crafted serialized payload over the network. The flaw is an untrusted-data deserialization (CWE-502) rated CVSS 9.8 with PR:N/UI:N, meaning no credentials or user interaction are required. No public exploit identified at time of analysis, but the pre-auth network vector and SharePoint's long history as an attacker target make this a high-priority patch.

Technical ContextAI

SharePoint is Microsoft's enterprise collaboration and document-management platform built on ASP.NET and the .NET Framework, which relies heavily on serialization to persist and pass objects (view state, session data, workflow state) across web requests. CWE-502 (Deserialization of Untrusted Data) occurs when the application reconstructs .NET objects from attacker-controlled input without validating type or content, allowing gadget chains (e.g., BinaryFormatter/LosFormatter/ObjectDataProvider-style gadgets) to trigger code execution during object reconstruction. The affected CPEs - cpe:2.3:a:microsoft:microsoft_sharepoint_enterprise_server_2016, microsoft_sharepoint_server_2019, and microsoft_sharepoint_server_subscription_edition - identify server-side on-premises SharePoint installations rather than SharePoint Online, so exposure is tied to internet- or intranet-reachable SharePoint web front ends.

RemediationAI

Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-50522 to all SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition front-end and application servers; obtain the exact KB and fixed build from https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522 (the input does not include a specific build number, so confirm it there before deploying). Because SharePoint updates span multiple servers, follow Microsoft's patch order and run the SharePoint Products Configuration Wizard (PSConfig) on each server after installing the update so the fix is fully applied. Until patched, reduce exposure by removing SharePoint web front ends from direct internet reachability and restricting access to trusted networks or VPN, and place a WAF or reverse proxy in front to inspect and block anomalous serialized payloads to SharePoint endpoints; note these are only compensating controls that reduce reachability, do not eliminate the underlying deserialization flaw, and may break legitimate external collaboration scenarios.