Critical SharePoint RCE Vulnerability CVE-2023-29357 Actively Exploited

Key Takeaways

• A critical remote code execution (RCE) vulnerability, CVE-2026-50522, impacts on-premises Microsoft SharePoint servers.
• This flaw, with a CVSS score of 9.8, allows unauthenticated attackers to execute arbitrary code due to untrusted data deserialization.
• While Microsoft confirmed in-the-wild exploitation for a related flaw, CVE-2026-58644, honeypot observations suggest CVE-2026-50522 is also being actively targeted.
• Affected versions include SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.
• Microsoft released patches in its July 2026 security update, which should be applied immediately.

Critical SharePoint RCE Vulnerability Under Active Attack

A severe vulnerability identified as CVE-2026-50522 is causing significant concern among enterprise IT security teams. This flaw permits unauthenticated attackers to achieve remote code execution (RCE) on on-premises Microsoft SharePoint servers, posing a substantial risk to organizational infrastructure.

The vulnerability carries a critical CVSS score of 9.8 and originates from a deserialization of untrusted data flaw, a common weakness that has previously affected SharePoint. This bug class enables an attacker to send a specially crafted serialized object to a vulnerable endpoint without needing prior authentication or user interaction, leading to arbitrary code execution within the SharePoint server’s context.

The affected platforms include 64-bit deployments of Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.

In-the-Wild Exploitation Suspected for CVE-2026-50522

Successful exploitation of this vulnerability could result in a complete takeover of the server, the deployment of web shells, the exfiltration of application secrets, and the use of the compromised host as a pivot point for lateral movement across the network.

It is important to note that the same July 2026 patch cycle also addressed a related vulnerability, CVE-2026-58644. This companion flaw requires an attacker to possess at least Site Owner permissions to inject and execute code, distinguishing it from the fully unauthenticated nature of CVE-2026-50522.

While Microsoft has confirmed active exploitation of CVE-2026-58644 in the wild, direct confirmation of CVE-2026-50522 exploitation remains pending. However, its Exploit Prediction Scoring System (EPSS) score of approximately 19.7% indicates a significant near-term risk of exploitation.

Researchers at Defused, while monitoring honeypot traffic during the current wave of SharePoint attacks, have observed an undocumented .NET deserialization payload targeting SharePoint sign-in endpoints. These requests lack any authentication material, a pattern that aligns more closely with the unauthenticated profile of CVE-2026-50522 than with the Site Owner-gated CVE-2026-58644. This observation has prompted analysts to re-evaluate the ongoing activity, suggesting it is likely linked to CVE-2026-50522 rather than an unrelated zero-day.

Independent tracking by Check Point and Censys further confirms that both CVEs were disclosed and patched concurrently in the July 2026 update. Alarmingly, over 10,000 internet-facing SharePoint servers globally remain exposed to these vulnerabilities.

Affected Versions and Patches

Organizations must ensure their SharePoint deployments are updated to the latest secure versions to mitigate these critical risks. The following table outlines the affected products and the necessary updates:

What You Should Do

• Immediately apply Microsoft’s July 2026 security update across all SharePoint farm members. Inconsistent patching can leave critical gaps for lateral exploitation.
• Retire or upgrade any unsupported SharePoint deployments that are unable to receive the necessary fixes.
• Implement robust monitoring for anomalous requests targeting sign-in and authentication endpoints, particularly unauthenticated .NET deserialization payloads that deviate from known proof-of-concept traffic.
• Where feasible, restrict the internet exposure of on-premises SharePoint servers, considering the thousands of instances still openly accessible as tallied by Shadowserver.
• Review the CISA’s Known Exploited Vulnerabilities catalog, which already lists the paired CVE-2026-58644 as actively exploited under Binding Operational Directive requirements.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.