CISA adds SharePoint CVE-2026-50522 to KEV with July 25 deadline

CISA has added CVE-2026-50522, a Microsoft SharePoint Server remote code execution flaw, to the Known Exploited Vulnerabilities catalog with a July 25, 2026 remediation deadline for federal agencies. The entry matters beyond government networks because KEV additions are one of the clearest public signals that exploitation is no longer theoretical.

The CVE record describes the bug as deserialization of untrusted data in Microsoft Office SharePoint that can let an unauthenticated attacker execute code over a network. Security reporting now links the flaw to active exploitation after public proof-of-concept details circulated, so internet-facing SharePoint Server instances should move to the top of the patch queue.

SharePoint Server is the affected surface

This is an on-premises SharePoint Server issue, not a general Microsoft 365 SharePoint Online warning. Microsoft's July 14 SharePoint Server 2016 security update says the package resolves several SharePoint and Office vulnerabilities, including remote code execution issues, and points administrators to the relevant security advisories.

Teams running SharePoint Server Subscription Edition, SharePoint Server 2019, or older supported SharePoint Server deployments should verify the exact Microsoft update path for their build. Treat older exposed servers, custom web parts, federation integrations, and legacy authentication flows as higher-risk until patch state and indicators are checked.

Why CVE-2026-50522 is urgent

CISA listed CVE-2026-50522 on July 22 and set the due date for July 25. That three-day window is short because KEV entries reflect evidence of active exploitation and because SharePoint flaws can become persistence footholds when attackers recover configuration secrets or machine keys.

The Hacker News, citing watchTowr research, reported exploitation after public PoC availability and warned that attackers were targeting machine keys to maintain access. That detail changes the operational response: patching is necessary, but it may not be enough for servers that were reachable before the update.

What defenders should do now

First, apply the relevant Microsoft SharePoint Server security updates and confirm the build number across every front-end and application server. Do not assume a load-balanced farm is clean because one node reports the new version.

Second, review logs for suspicious SharePoint requests, unexpected process launches, newly written web-accessible files, and authentication activity around the window before patching. If compromise is plausible, rotate exposed secrets and machine keys according to Microsoft's and your incident-response team's guidance.

Third, reduce exposure while validation is underway. Put administrative endpoints behind VPN or identity-aware access, block direct internet reachability where possible, and confirm EDR coverage on SharePoint hosts. Back up configuration before changes, but do not preserve vulnerable public access just to avoid downtime.

Evidence and caveats

The strongest signal is CISA's KEV listing, backed by the CVE record and Microsoft's SharePoint security update pages. Independent reporting adds exploitation context, but defenders should use vendor guidance for exact patches and supported versions.

One caveat: CVE naming around July 2026 SharePoint activity is crowded, with several SharePoint flaws appearing in CISA alerts and researcher writeups. Track CVE-2026-50522 separately from earlier July SharePoint entries, then check whether your environment needs broader hardening for the whole campaign rather than a single patch.

The practical next step is simple: if you run on-premises SharePoint Server, verify CVE-2026-50522 patch status today, then decide whether exposed systems need key rotation and forensic review before the July 25 KEV deadline passes.