Microsoft SharePoint CVE-2026-50522

Exploitation requires only network access to a vulnerable SharePoint Server endpoint that deserializes attacker-controlled data; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote exploitation with no user interaction against affected on-premises SharePoint 2016/2019/Subscription Edition. The primary limiting factor is reachability: only on-premises SharePoint Server front ends are affected (not SharePoint Online), so the target SharePoint web application must be network-reachable by the attacker, and the specific vulnerable feature/endpoint performing the unsafe deserialization should be confirmed from the Microsoft advisory. No non-default configuration or platform beyond a supported affected SharePoint version is indicated by the available data.

All available signals point to genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) indicates a network-reachable, low-complexity attack requiring no privileges and no user interaction, with full compromise of confidentiality, integrity, and availability. CWE-502 deserialization flaws in SharePoint are historically reliable and weaponizable, and the class is well understood by attackers. No EPSS score, KEV listing, or POC was provided in the input, so exploitation probability cannot be quantified and there is no public exploit identified at time of analysis; however, absence of these signals is not evidence of low risk. The main open question is whether real-world reachability requires a specific SharePoint feature or endpoint - the description states unauthenticated network RCE with no caveats, so it should be treated as broadly exploitable until the vendor advisory indicates otherwise.

An attacker who can reach a SharePoint web front end sends a single crafted HTTP request containing a malicious serialized .NET object to a vulnerable endpoint. When SharePoint deserializes the payload, a gadget chain executes attacker-supplied code in the context of the SharePoint web application, yielding code execution on the server without any credentials or user interaction. No public exploit was identified at time of analysis, but the low-complexity, pre-auth nature makes reliable exploitation likely once tooling emerges.