What’s Vulnerable › Vulnerabilities

CVE-2026-50522: Microsoft SharePoint Remote Code Execution Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-07-22
• EPSS: 3.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-14 · updated 2026-10-28
• Weakness: CWE-502

Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Summary

CVE-2026-50522 is a critical deserialization of untrusted data flaw in Microsoft SharePoint Server that lets an unauthenticated attacker execute code over the network (CVSS 9.8). It is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, so internet-facing SharePoint instances are at immediate risk. The issue is fixed in version 16.0.19725.20434; apply that update or the vendor's mitigations promptly, and follow CISA BOD 26-04 guidance, discontinuing use if mitigations are unavailable.

CVE-2026-50522 ثغرة حرجة من نوع إزالة تسلسل البيانات غير الموثوقة في Microsoft SharePoint Server، وتتيح لمهاجم غير مصرح له تنفيذ تعليمات برمجية عبر الشبكة (CVSS 9.8). الثغرة مدرجة في كتالوج CISA للثغرات المعروفة باستغلالها مع استغلال نشط، ما يعرض خوادم SharePoint المتاحة عبر الإنترنت لخطر مباشر. تم إصلاح المشكلة في الإصدار 16.0.19725.20434، لذا يجب تطبيق التحديث أو التخفيفات التي يوصي بها المورّد فورًا، مع اتباع إرشادات CISA BOD 26-04 والتوقف عن استخدام المنتج إذا تعذر تطبيق التخفيفات.

Affected products

• Microsoft SharePoint Server: before 16.0.19725.20434; 2016, 2019 — fixed in 16.0.19725.20434
• Microsoft SharePoint Server Subscription Edition: from 16.0.0 before 16.0.19725.20434 — fixed in 16.0.19725.20434
• Microsoft Sharepoint Enterprise Server 2016: from 16.0.0 before 16.0.5561.1001 — fixed in 16.0.5561.1001
• Microsoft SharePoint Server: from 16.0.0 before 16.0.10417.20175 — fixed in 16.0.10417.20175

How to fix

Upgrade to a fixed version: Microsoft SharePoint Server 16.0.19725.20434; Microsoft SharePoint Server Subscription Edition 16.0.19725.20434; Microsoft Sharepoint Enterprise Server 2016 16.0.5561.1001; Microsoft SharePoint Server 16.0.10417.20175. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50522

Get alerted when CVE-2026-50522 or the next vulnerability affects your stack