What Is CVE-2026-50522 (Microsoft SharePoint Deserialization of Untrusted Data Vulnerability)?

By NHI Mgmt Group Updated October 17, 2026 Domain: Threats, Abuse & Incident Response

CVE-2026-50522 is a deserialization of untrusted data vulnerability vulnerability in Microsoft SharePoint. CISA added it to the Known Exploited Vulnerabilities catalogue on 22 July 2026, which means attackers have used it in real attacks. Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.

What Microsoft SharePoint deserialization of untrusted data means

Deserialization flaws are dangerous because they let an application turn attacker-controlled input into executable application state. In a product like SharePoint, that can move a malformed request from “data” into code paths that the server trusts too much.

For readers tracking exploited vulnerability patterns, the key point is not the serialization format itself, but the trust boundary it crosses. When that boundary is weak, an unauthorised remote requester may be able to trigger unsafe object handling and reach code execution.

Why this vulnerability class is serious in SharePoint

SharePoint is a high-value collaboration platform, so a server-side code execution issue can have outsized impact. An attacker who gains code execution over the network may be able to read content, tamper with sites, harvest secrets, or pivot further into connected Microsoft 365 and on-premises environments.

This kind of flaw is especially dangerous when SharePoint is internet-facing or reachable from broad internal networks. Even when the initial exploit is narrow, successful execution can expose documents, workflow data, authentication material, and administrative context that should never be reachable by an unauthorised actor.

For the official record of the vulnerability family and authoritative patch details, use the CVE Program entry and the NIST National Vulnerability Database rather than relying on secondary summaries.

How organisations assess exposure and reduce attack surface

Exposure checks start with a complete inventory of SharePoint deployments, including internet-facing instances, internal application tiers, and any environments that proxy or front-end the service. Organisations should then confirm whether the affected product is present in production, disaster recovery, or unmanaged test systems that still carry real data.

Vendor advisories and the CISA KEV catalogue should be used together to determine whether the issue is both exploitable and operationally urgent. When a flaw is already being exploited in the wild, the priority is no longer abstract vulnerability management, it becomes exposure reduction for a live attack path.

Where immediate patching is difficult, compensating controls matter. Restrict network reachability, narrow administrative access, review inbound request paths, and limit the blast radius of any SharePoint server that must remain online until remediation is complete. NHIMG’s Vulnerability Management Guide is useful for understanding how KEV status, asset scope, and remediation priority fit together in practice.

Detection, compromise review, and recovery considerations

Because the vulnerability can allow code execution, detection should not stop at patch confirmation. Teams should review web server and SharePoint logs for unusual requests, abnormal process creation, unexpected child processes, newly written files, and signs that the attacker used the initial foothold to stage additional tooling.

Post-patch review is important because exploited SharePoint servers may remain compromised even after the vulnerable code path is fixed. Search for web shells, suspicious scheduled tasks, new local accounts, unusual outbound connections, and other persistence mechanisms that can survive a clean patch.

If evidence shows exploitation, treat identity and secret exposure as possible follow-on issues. Rotate credentials, tokens, certificates, and any service accounts that may have been accessible from the compromised SharePoint host, then validate that the attacker did not preserve access through a separate trust relationship. NHIMG’s ToolShell SharePoint exploitation 2025 analysis is a useful reminder that patching alone does not always remove post-exploitation access.

Risk and Threat Considerations

This vulnerability is materially risky because it gives a remote attacker a path from untrusted input to code execution on a collaboration platform that often stores sensitive business data. Once exploited, SharePoint can become a staging point for deeper compromise, persistence, or lateral movement.

Failure mechanism: The application trusts and deserializes attacker-controlled content, allowing crafted data to influence server-side object behaviour and reach executable logic.

Impact: Attackers may gain remote code execution, steal content or credentials, plant persistence, and use the SharePoint server as a foothold for broader enterprise compromise.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	This issue depends on timely finding and prioritising an actively exploited server vulnerability.
Recommendation — Prioritise the SharePoint exposure in continuous vulnerability management and verify remediation with rescans.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The term is an exploited software flaw requiring controlled remediation and verification.
	SI-4 — System Monitoring	Exploitation review depends on monitoring logs and indicators of compromise after patching.
	AC-6 — Least Privilege	Reducing the blast radius of SharePoint compromise depends on limiting privileged access paths.
Recommendation — Remediate the SharePoint flaw and confirm patched hosts no longer expose the vulnerable code path. Monitor SharePoint and host telemetry for exploitation indicators and post-patch persistence. Restrict administrative and service privileges around SharePoint to reduce post-exploitation impact.

Practitioner Guidance

Why practitioners should care: Treat any KEV-listed SharePoint deserialization issue as an urgent exposure problem, not a routine bugfix. The business consequence is not only service risk, but the possibility that a shared enterprise platform becomes an attacker-controlled execution point.

What to watch for: If the server is internet-facing, if logs show anomalous requests to SharePoint endpoints, or if the host has not yet been verified clean after patching, elevate the case for immediate containment and compromise review.

Practitioner takeaway: Prioritise patching, but do not stop there, confirm whether the server was already abused and assume any exposed secrets or sessions on that host may need rotation.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org

CVE-2026-50522 (Microsoft SharePoint Deserialization of Untrusted Data Vulnerability)