SharePoint RCE Flaw Exploited for Machine Keys

Attackers are actively exploiting CVE-2026-50522, a critical deserialization vulnerability in Microsoft SharePoint, to steal machine keys and maintain persistent access after patching. The flaw, addressed in July's security updates, allows unauthenticated remote code execution. watchTowr detected exploitation within hours of a public proof-of-concept, and Defused observed related attacks as early as July 17.