Attackers are actively exploiting a critical Microsoft SharePoint remote code execution vulnerability (CVE-2026-50522) to steal IIS machine keys.

WatchTowr observed active exploitation of CVE-2026-50522 against on-premise Microsoft SharePoint deployments, with successful attempts registered shortly after public exploit code was released. This unauthenticated flaw allows attackers to read arbitrary server files, and organizations are urged to patch quickly, enable Antimalware Scan Interface (AMSI) integration, and rotate IIS machine keys after remediation.

Context

CVE-2026-50522 is a remote code execution vulnerability in Microsoft SharePoint that was recently identified. It became a target for attackers shortly after exploit code was made public, indicating a heightened threat environment. Organizations utilizing on-premise SharePoint deployments are particularly vulnerable if they do not implement necessary security measures.

Why it matters

The exploitation of CVE-2026-50522 poses a significant risk to organizations using Microsoft SharePoint, as it allows attackers to access sensitive server files. This vulnerability can lead to unauthorized access and data breaches, potentially compromising critical information. Prompt action is essential to mitigate these risks and protect organizational assets.

Implications

If left unaddressed, this vulnerability could lead to widespread data breaches, affecting both the integrity and confidentiality of organizational data. Organizations that fail to act may face legal repercussions and reputational damage. IT departments and security teams will need to prioritize this issue to safeguard their infrastructure.

What to watch

Organizations should monitor their SharePoint systems for signs of exploitation and ensure they apply patches as soon as they are available. Additionally, the effectiveness of implemented security measures, such as Antimalware Scan Interface integration, should be evaluated. The response from Microsoft regarding further guidance or updates will also be significant.