sharepoint Archives | Security Sense

Overview

CVE-2026-50522 is a critical deserialization of untrusted data vulnerability affecting Microsoft SharePoint Server. This flaw allows an unauthorized attacker to execute arbitrary code remotely over a network without user interaction. The vulnerability is actively exploited in the wild, posing a significant risk of full SharePoint compromise and potential lateral movement, including machine key theft.

Technical Analysis

The vulnerability, classified as CWE-502 (Deserialization of Untrusted Data), exists within Microsoft SharePoint Server. An attacker can exploit this flaw by sending specially crafted network requests that, when deserialized by the SharePoint application, lead to arbitrary code execution.

Vulnerability Type: Deserialization of Untrusted Data (CWE-502).
Affected Products:
- microsoft sharepoint_server versions prior to 16.0.19725.20434
- microsoft sharepoint_server 2016
- microsoft sharepoint_server 2019
CVSS v3.1 Score: 9.8 (CRITICAL) – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector: Network (AV:N). No authentication or user interaction is required (PR:N, UI:N).
Impact: Complete compromise of confidentiality, integrity, and availability (C:H, I:H, A:H) due to remote code execution.
Exploitation: Publicly reported exploitation includes the theft of SharePoint machine keys, which can lead to further compromise of the SharePoint farm. The ViewState malware family is linked to exploitation.

Detection

Detection efforts should focus on identifying post-exploitation activity and suspicious network requests targeting SharePoint servers.

Process Creation Monitoring: Monitor for unusual child processes spawned by SharePoint-related processes (e.g., w3wp.exe, owstimer.exe). Look for cmd.exe, powershell.exe, pwsh.exe, mshta.exe, cscript.exe, wscript.exe, or other scripting/system utilities.
Web Server Logs: Analyze IIS/web server logs for SharePoint for unusual POST requests, particularly those with large payloads, suspicious user agents, or requests to uncommon application pages.
File System Monitoring: Monitor for new or modified files in SharePoint web directories (_layouts, _vti_bin, wpresources) that could indicate webshell deployment or other persistence mechanisms.
Network Traffic Analysis: Look for unusual outbound connections from SharePoint servers to external IPs, especially after suspicious inbound requests.
Registry/File Access: Monitor for access to SharePoint configuration files (web.config) or registry keys related to machine keys, as this has been observed in active exploitation.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

SharePoint IIS Worker Suspicious Child Process

title: SharePoint IIS Worker Suspicious Child Process
id: d7e0f8b1-c9a3-4e6d-b2f5-a1c8e7d4f0a9
status: experimental
description: Detects suspicious process creation (e.g., cmd, powershell) by an IIS worker process (w3wp.exe), which is a common indicator of RCE on SharePoint servers.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: '\\w3wp.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\mshta.exe'
      - '\\cscript.exe'
      - '\\wscript.exe'
  condition: selection
level: critical

SharePoint Timer Service Suspicious Child Process

title: SharePoint Timer Service Suspicious Child Process
id: e9c2d1a0-f3b4-4c5d-a6e7-b8f9c0d1e2f3
status: experimental
description: Detects suspicious process creation (e.g., cmd, powershell) by the SharePoint Timer Service (owstimer.exe), which can also be exploited for RCE.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: '\\owstimer.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\mshta.exe'
      - '\\cscript.exe'
      - '\\wscript.exe'
  condition: selection
level: critical

Mitigations

Patch Immediately: Apply the latest security updates from Microsoft for SharePoint Server. Specifically, update to 16.0.19725.20434 or later for affected versions. Refer to the Microsoft Security Response Center (MSRC) advisory for CVE-2026-50522.
Network Segmentation: Isolate SharePoint servers from untrusted networks and segment them from other critical internal systems.
Least Privilege: Ensure SharePoint service accounts and application pools run with the minimum necessary privileges.
Web Application Firewall (WAF): Deploy a WAF in front of SharePoint servers to detect and block malicious web requests, though specific deserialization payloads may be difficult to block without specific signatures.
Regular Backups: Maintain regular, tested backups of SharePoint farms to facilitate recovery in case of compromise.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50522
https://nvd.nist.gov/vuln/detail/CVE-2026-50522
https://thehackernews.com/2026/07/critical-sharepoint-rce-cve-2026-50522.html
https://www.resecurity.com/blog/article/from-web-request-to-domain-compromise-understanding-the-july-2026-sharepoint-attacks
https://www.bleepingcomputer.com/news/security/critical-sharepoint-rce-flaw-exploited-to-steal-machine-keys/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

T1190 — Exploit Public-Facing Application
T1059 — Command and Scripting Interpreter
T1552.004 — Private Keys
T1505.003 — Web Shell
T1036 — Masquerading
T1530 — Data from Cloud Storage
T1213 — Data from Information Repositories
T1059.001 — PowerShell

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  2,289 input / 1,875 output tokens ·

  Reviewed and approved by a human analyst before publication

Overview

CVE-2026-58644 is a critical deserialization of untrusted data vulnerability affecting Microsoft SharePoint Server. This flaw allows an unauthenticated attacker to execute arbitrary code remotely over the network. Given its high severity (CVSS 9.8) and potential for complete system compromise without user interaction, this vulnerability poses a significant risk to organizations utilizing vulnerable SharePoint deployments.

Technical Analysis

The vulnerability, categorized as CWE-502 (Deserialization of Untrusted Data), resides within Microsoft SharePoint. An attacker can craft malicious serialized data and send it to a vulnerable SharePoint instance. When the SharePoint application attempts to deserialize this untrusted data, it can lead to the execution of arbitrary code in the context of the SharePoint server process. This attack does not require authentication or user interaction, making it highly impactful.

Vulnerability Type: Deserialization of Untrusted Data (CWE-502)
Affected Products:
- Microsoft SharePoint Server < 16.0.19725.20434
- Microsoft SharePoint Server 2016
- Microsoft SharePoint Server 2019
Attack Vector: Network (AV:N)
Authentication: Not required (PR:N)
User Interaction: Not required (UI:N)
Impact: Complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H)

Detection

Detection efforts should focus on identifying anomalous process creation originating from SharePoint worker processes, as well as suspicious network traffic patterns indicative of exploitation attempts.

Process Monitoring: Monitor for unusual child processes spawned by SharePoint-related processes (e.g., w3wp.exe, owstimer.exe, or other SharePoint service executables). Look for cmd.exe, powershell.exe, pwsh.exe, or other scripting interpreters and uncommon executables.
Network Traffic Analysis: Look for unusual HTTP/HTTPS requests to SharePoint endpoints that may contain serialized payloads or unexpected data structures. Monitor for outbound connections from SharePoint servers to unknown external IP addresses or domains.
Application Logs: Review SharePoint ULS logs and IIS logs for errors related to deserialization or unexpected application behavior immediately preceding suspicious process activity.
Endpoint Telemetry: Hunt for EventID 1 (Process Creation) in Sysmon logs where ParentImage is a SharePoint process and Image is a shell or scripting interpreter.

Sigma Detection Rules

SharePoint Worker Process Spawning Cmd.exe

title: SharePoint Worker Process Spawning Cmd.exe
id: 9a7b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects suspicious execution of cmd.exe by an IIS worker process (w3wp.exe) which commonly hosts SharePoint, indicating potential RCE via CVE-2026-58644.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    ParentImage|endswith: '\\w3wp.exe'
    Image|endswith: '\\cmd.exe'
  condition: selection
level: high

SharePoint Worker Process Spawning PowerShell.exe

title: SharePoint Worker Process Spawning PowerShell.exe
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects suspicious execution of powershell.exe by an IIS worker process (w3wp.exe) which commonly hosts SharePoint, indicating potential RCE via CVE-2026-58644.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    ParentImage|endswith: '\\w3wp.exe'
    Image|endswith: '\\powershell.exe'
  condition: selection
level: high

Mitigations

Prioritize patching and implement compensating controls to reduce the attack surface.

Apply Patches: Immediately apply the security update from Microsoft. For SharePoint Server Subscription Edition, update to version 16.0.19725.20434 or later. Apply the latest cumulative updates for SharePoint Server 2016 and 2019 that address CVE-2026-58644.
Network Segmentation: Isolate SharePoint servers on a dedicated network segment with strict ingress/egress filtering to limit unauthorized access.
Web Application Firewall (WAF): Deploy a WAF in front of SharePoint servers to detect and block malicious requests, particularly those attempting to exploit deserialization vulnerabilities. Configure the WAF to inspect request bodies for suspicious serialized data patterns.
Least Privilege: Ensure SharePoint service accounts operate with the minimum necessary privileges.
Regular Backups: Maintain regular, tested backups of SharePoint farms to facilitate recovery in the event of a successful compromise.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644
https://nvd.nist.gov/vuln/detail/CVE-2026-58644

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

T1190 — Exploit Public-Facing Application
T1210 — Exploitation of Remote Services
T1059.003 — Windows Command Shell
T1059.001 — PowerShell

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  1,755 input / 1,551 output tokens ·

  Reviewed and approved by a human analyst before publication

Tag: sharepoint

CVE-2026-50522: Critical SharePoint RCE via Deserialization of Untrusted Data

Overview

Technical Analysis

Detection

Sigma Detection Rules

SharePoint IIS Worker Suspicious Child Process

SharePoint Timer Service Suspicious Child Process

Mitigations

References

Indicators of Compromise

MITRE ATT&CK

CVE-2026-58644: Microsoft SharePoint Deserialization RCE

Overview

Technical Analysis

Detection

Sigma Detection Rules

SharePoint Worker Process Spawning Cmd.exe

SharePoint Worker Process Spawning PowerShell.exe

Mitigations

References

Indicators of Compromise

MITRE ATT&CK