Cyber Resilience

CVE-2026-50522

RCE in Microsoft Sharepoint Server ≤ 16.0.19725.20434

CISA KEVActive ExploitationEUVD ExploitedRCEDeserialization
Published
14 July 2026
Modified
23 July 2026
KEV Added
22 July 2026
Patch / advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.63 99.1th percentile
Risk Priority 97 floored blend · peak EPSS

Summary

CVE-2026-50522 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Microsoft Sharepoint Server. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.9% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-7 (Software, Firmware, and Information Integrity) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

CWE(s)
KEV Date Added
22 July 2026

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Remote code execution via deserialization in SharePoint (public-facing web app) directly enables T1190.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Deserialization flaw in public-facing SharePoint server directly enables remote code execution.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-53770Same product: Microsoft Sharepoint Serverboth on KEV
CVE-2026-20963Same product: Microsoft Sharepoint Serverboth on KEV
CVE-2026-58644Same product: Microsoft Sharepoint Serverboth on KEV
CVE-2026-45659Same product: Microsoft Sharepoint Serverboth on KEV
CVE-2025-49712Same product: Microsoft Sharepoint Server
CVE-2025-59237Same product: Microsoft Sharepoint Server
CVE-2025-54897Same product: Microsoft Sharepoint Server
CVE-2026-40357Same product: Microsoft Sharepoint Server
CVE-2024-38094Same product: Microsoft Sharepoint Serverboth on KEV
CVE-2026-33112Same product: Microsoft Sharepoint Server

Affected Assets

microsoft
sharepoint server
2016, 2019 · ≤ 16.0.19725.20434

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SC-7 Boundary Protection
Detect
Catch it (NIST detect / respond)
  • SI-7 Software, Firmware, and Information Integrity
Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation of untrusted inputs before deserialization, blocking the malicious object construction that enables RCE.

detect

Mandates integrity verification of software and data, detecting unauthorized code or objects introduced via deserialization.

prevent

Enforces boundary filtering and inspection of network traffic to SharePoint, limiting exposure to untrusted serialized payloads.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-02 none match
prevents

PR.PS-02 addresses only post-deployment updates/patching and cannot prevent introduction of unsafe deserialization code, yet it can remediate some instances when the flaw exists in outdated libraries or components.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing includes validation of deserialization routines and the use of untrusted data, reducing the likelihood that unsafe object reconstruction will be deployed.

prevents

Requiring vetted libraries, regular updates and SAST before release reduces the likelihood that deserialization logic will accept and act on attacker-controlled serialized objects.

detects

Regular scanning of third-party libraries and timely patching reduce the likelihood that unsafe deserialization vulnerabilities remain active.

none

Mandatory malware scanning of data received over networks or storage media intercepts malicious serialized payloads before they are deserialized by the target application.

References