SharePoint vulnerabilities could allow for remote code execution
CVE-2026-50522 and CVE-2026-58644 are critical deserialization vulnerabilities in on-premise hosted Microsoft SharePoint, which allow for attacker remote code execution.
CVE-2026-50522 has a 9.8 severity rating and is now under exploitation, according to researchers.
The CVE-2026-50522 vulnerability is the result of insufficient validation before deserializing user provided data within the SessionSecurityTokenHandler class. This is part of the Windows Identity Foundation token-processing framework used by .NET applications to read, serialize, and deserialize SessionSecurityToken objects.
On a high level, exploitation of the of the vulnerability is as follows:
- An authenticated attacker sends a specially crafted request with constructed data to an unpatched SharePoint server.
- The data reaches the SharePoint authentication or session-token processing path.
SessionSecurityTokenHandlerinterprets the supplied data as a serialized object or token.- Inadequate type or content validation permits attacker-controlled object processing.
- A usable .NET gadget or related execution path causes code to run in the SharePoint server context.
Potential impact resulting from successful exploitation may range from arbitrary command or assembly execution, deployment of webshells or other persistence mechanisms, access to SharePoint content databases and configuration material, theft of application-pool, farm or service account credentials, credential or token forgery, and lateral movement into systems accessible or connected to the SharePoint farm.
When used in tandem with other vulnerabilities, it is entirely possible for an attacker to execute code in the context of the SharePoint service account.
The CVE-2026-58644 vulnerability leverages SharePoint’s network facing server-side request processing and allows attackers to craft and send malicious serialized data to a vulnerable processing path. Due to a flaw in validation from a vulnerable class (both of which are undisclosed), this malicious data is accepted and deserialized.
When SharePoint accepts and reconstructs the request, it’s reconstructing attacker-controlled object graphs. The resulting deserialized data allows attackers to obtain server-side code execution, enabling malicious activities such as data exfiltration, delivery of additional malware, and persistence within an organization.
It should be noted that privileges of at least Site Owner are required for these exploits, which is one level of privilege above a site member or visitor. Although there are several levels of privilege above Site Owner, this exploit would allow execution on the local server under the context held by the SharePoint process.
Additional emphasis should be placed on theft of IIS or ASP.NET machine keys. These keys may enable attackers to generate authentication or application-state material that the server accepts as legitimate.
Patching the vulnerabilities is an excellent mitigation tactic, however, patching doesn’t necessarily remove the persistence mechanism if the keys have already been compromised.
Affected versions of SharePoint
CVE-2026-58644
- Microsoft SharePoint Server Subscription Edition
- Earlier than:
16.0.19725.20384
- Earlier than:
- Microsoft SharePoint Server 2019
- Earlier than:
16.0.10417.20153
- Earlier than:
- Microsoft SharePoint Enterprise Server 2016
- Earlier than:
16.0.5556.1005
- Earlier than:
CVE-2026-50522
- Microsoft SharePoint Server Subscription Edition
- Earlier than:
16.0.19725.20434
- Earlier than:
- Microsoft SharePoint Server 2019
- Earlier than:
16.0.10417.20175
- Earlier than:
- Microsoft SharePoint Enterprise Server 2016
- Earlier than:
16.0.5561.1001
- Earlier than:
Security Patches available for:
- Microsoft SharePoint Server Subscription Edition
- Build number:
16.0.19725.20434 - KB5002891
- Build number:
- Microsoft SharePoint Server 2019
- Build number:
16.0.10417.20175 - KB5002883
- Build number:
- Microsoft SharePoint Enterprise Server 2016
- Build number:
16.0.5561.1001 - KB5002891
- Build number:
It is recommended to immediately apply the latest cumulative updates for SharePoint Server (2016, 2019, Subscription Edition).
Recommendations For ThreatLocker Partners
Organizations with Zero Trust Endpoint Firewall or Zero Trust Network Access (ZTNA) should restrict access to on-premise SharePoint servers to only ThreatLocker-secured or explicitly approved devices.
