SharePoint RCE flaw exploited for machine keys

Hackers are actively exploiting CVE-2026-50522, a critical deserialization flaw in Microsoft SharePoint, to steal machine keys and maintain persistent access after patching. watchTowr detected exploitation attempts within hours of a public proof-of-concept exploit. Defused observed related attacks as early as July 17. Microsoft addressed the flaw in July's security updates.