Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC

A third SharePoint Server flaw patched by Microsoft as part of its Patch Tuesday update for July 2026 has come under active exploitation, per watchTowr. The vulnerability in question is CVE-2026-50522 (CVSS score: 9.8), a critical deserialization of untrusted data in Microsoft Office SharePoint that could allow an unauthorized attacker to execute code over a network. Microsoft credited DEVCORE

The article reports that CVE-2026-50522, a critical remote code execution vulnerability (CVSS 9.8) in on‑premises Microsoft SharePoint Server, is under active exploitation following the release of a public proof-of-concept exploit.[1][6][8] Public advisories note that unauthenticated or minimally authenticated attackers can exploit deserialization of untrusted data in SharePoint to execute arbitrary code over the network and steal sensitive IIS machine keys for persistence.[1][2][4][7][8][10] From a RealGround AI-security perspective, this illustrates how widely deployed enterprise platforms in an organization’s software supply chain—such as SharePoint instances that may host AI agents, data pipelines, or model artifacts—can become initial access vectors, enabling attackers to pivot into AI infrastructure and access models, training data, or orchestration secrets if these systems are co-located or integrated. Organizations should treat internet-exposed or previously vulnerable SharePoint servers as potentially compromised, perform forensic review and credential/machine-key rotation, and incorporate these dependencies into AI SBOM, supply-chain risk assessments, and continuous red t