SharePoint CVE-2026-50522: stolen machine keys outlast the patch

A KEV alert dropped for CVE-2026-50522 late Tuesday night while I was asleep, and by the time I read it Wednesday morning, honeypot operators at watchTowr were already reporting successful unauthenticated remote code execution against on-premises SharePoint. The bug shipped a fix on Patch Tuesday July 14 without an exploited-in-the-wild tag. Then a public proof of concept dropped on Sunday July 20, honeypots lit up within hours, and CISA added it to KEV on July 22. The twist that ate my morning is not the CVSS 9.8 label. It is the shape of the persistence: a single request steals the SharePoint machine keys, and applying the patch does nothing to invalidate keys an attacker has already walked away with.

What actually happens at /_trust/default.aspx

SharePoint Server, when configured for federated authentication, exposes a small handler at /_trust/default.aspx. It exists to receive the sign-in response from an external identity provider using the WS-Federation passive requestor protocol. In practice, a browser lands on a SharePoint site, the site redirects to the trusted IdP, the user authenticates, and the IdP POSTs an XML blob back to /_trust/default.aspx in the wresult form field. That blob contains a signed token that SharePoint parses to establish a session cookie. This is the intended flow, present on every SharePoint Server 2016, 2019, and Subscription Edition install with federated auth enabled or provisioned. No login required to hit the endpoint.

The vulnerable code path lives inside the token parser that reads a SecurityContextToken element out of the wresult payload. That element carries a Cookie child whose bytes are the serialized session state. Per SOCRadar's writeup and SecurityAffairs, the flaw sits in SessionSecurityTokenHandler from the Windows Identity Foundation stack: it hands attacker-controlled cookie bytes to BinaryFormatter without a serialization binder that restricts allowed types. Any .NET gadget chain that resolves to an executable type on the SharePoint AppDomain runs.

The token cookie the deserializer never should have touched

Insufficient type validation before deserialization is CWE-502, the same class of bug that produced almost every serious SharePoint RCE of the last three years. What makes this instance interesting is what the public exploit does with the primitive. The PowerShell PoC published by researcher Janggggg, described in the SOCRadar and BleepingComputer coverage, does more than spawn a shell. It uses the deserialization primitive to walk the SharePoint worker process memory, locate the ASP.NET machine key configuration, and return the validationKey and decryptionKey in the HTTP response body of that same request. One unauthenticated POST, no second-stage callback, and the attacker walks away with the keys before the response headers have finished writing.

Those keys are the roots of trust for every signed and encrypted artifact ASP.NET produces on that server: ViewState, forms authentication cookies, anti-forgery tokens, and the SecurityContextToken cookies that come back through /_trust/default.aspx. An attacker who has both keys can forge any of those artifacts offline, sign them correctly, and present them at the front door. The server has no way to tell the forgery from the real thing because the forgery is cryptographically valid.

Why CVSS 9.8 alone undersells this one

The CVSS vector reads correctly for the immediate impact: network attack, no user interaction, high confidentiality, integrity, and availability. Every 9.8 in your queue looks the same at the ranker layer, though, and this one does not behave like the others. A normal 9.8 RCE finishes with "patch and re-image the box, review the logs, done." This one has a persistence tail the score does not carry. Patch on Wednesday, skip the machine key rotation, and any attacker who ran the exploit in the exposure window between July 20 and your patch time still holds signed tokens that your patched server will accept. A scanner that reports "SharePoint patched" on July 15 is technically correct and operationally wrong.

EPSS and KEV help you see the storm coming and the urgency of the initial patch. Neither surfaces the "rotate three cryptographic secrets on every front-end web server" tail. That gap is where scanner-driven triage leaves work on the floor.

The TRIS layers on CVE-2026-50522

TRIS, the Threat and Risk Intelligence Scoring engine inside CVEasy AI, splits scoring into layers so the same CVE reads differently depending on your actual exposure. On this finding, four layers matter.

Exploitation Signal. A public PoC dropped July 20 from researcher Janggggg, watchTowr honeypots recorded successful unauthenticated attempts within hours of that release, and CISA added the CVE to KEV on July 22, which pins this layer to the top band. Worth being explicit, though: a proven PoC plus honeypot hits is very strong evidence that everyone reachable will be probed soon, not proof that any specific organization has already been breached, and TRIS treats it as the loudest possible early warning rather than as an incident closure.

Reachability. If your SharePoint front-end web servers publish /_trust/default.aspx to the public internet, either directly or through a reverse proxy that does not gate the trust path, you are directly reachable and this layer stays high. If the trust endpoint is behind private networking and only reachable from an internal IdP subnet, this layer drops meaningfully, which is why the same CVE can sit at ACT on one farm and Attend on another under the same score.

Persistence Tail. This one is distinctive to CVE-2026-50522. The vulnerability leaves stolen machine keys behind that the patch does not touch, so TRIS adds a tail multiplier that stays elevated on any node where evidence of a post-patch machine key rotation is missing, and the multiplier only collapses once the rotation is observed on that specific server.

Consequence. SharePoint typically holds indexed documents, shares OneDrive-linked identities, and runs under a service account with broader access than the box itself, so impact fans out past the compromised web server into whatever the SharePoint process account can read, write, or federate against.

An internet-reachable, unpatched, un-rotated SharePoint front-end lands at ACT (top band). A segmented instance behind private networking with the July 14 update installed and machine keys rotated afterwards drops into a much lower band. Same CVE, honestly different real-world risk. That split is exactly the work CVSS is not designed to do.

Patch, rotate, hunt: the honest weekend list

1. Install the July 2026 SharePoint cumulative update on every node. Pull the exact package for your product edition from the Microsoft Security Update Guide entry for CVE-2026-50522 and apply on Server 2016, Server 2019, and Subscription Edition. Patch first, everything else after.

2. Rotate machineKey on every SharePoint front-end web server. Generate a new validationKey and decryptionKey pair, update web.config on each server, then run iisreset. If your farm uses shared keys across nodes, roll them everywhere in the same maintenance window. Skip this step and the patch is decoration. Help Net Security's writeup is blunt on this point for the same reason.

3. Rotate SharePoint service account passwords. The attacker who ran the deserialization payload could have read any secret the SharePoint worker could read in-process. Roll the farm account, application pool identities, and any linked service credentials before assuming the blast radius is contained to the box.

4. Hunt IIS logs in the exposure window. Filter for POST requests to /_trust/default.aspx from unusual source IPs, especially bursts, especially with large bodies, between July 20 and your patch time. Correlate with unexpected child processes spawned by w3wp.exe: cmd.exe, powershell.exe, certutil.exe, or whoami descending from a SharePoint worker are strong signals.

5. Gate /_trust/default.aspx at the perimeter where you can. Many enterprise deployments only federate internally. If the trust endpoint has no legitimate reason to be internet-reachable in your topology, block it at the reverse proxy or WAF. Defense in depth, plus you get a clean audit trail if anyone tries.

How CVEasy AI surfaces CVE-2026-50522

CVEasy AI is the number one local-first CTEM (Continuous Threat Exposure Management) platform: it ingests the real sources for this class of event (Microsoft Security Update Guide, the CISA KEV feed, watchTowr and other researcher telemetry summaries, public PoC drops) and runs TRIS against the SharePoint inventory discovered on your own hardware. It answers the concrete questions that decide your week: which specific SharePoint nodes still need the July 14 cumulative, which of those have had machineKey rotated on the server after the install, which nodes are still reachable at /_trust/default.aspx from outside the enterprise, and which showed suspicious POST bursts to that endpoint in the exposure window. Your inventory, your IIS logs, and the reasoning stay on your hardware. TRIS holds the finding at ACT for any exposed and un-rotated node and only drops the band once rotation is observed on that specific server, so the ticket only closes once every affected node is patched and its keys are rotated.

Sources: BleepingComputer, SOCRadar, SecurityAffairs, Help Net Security, CISA KEV alert, The Hacker News.