Critical SharePoint RCE flaw exploited to steal machine keys

Hackers are actively exploiting a critical remote code execution vulnerability in Microsoft SharePoint, tracked as CVE-2026-50522, to steal machine keys and maintain persistent access even after affected servers are patched. The flaw, patched by Microsoft in its July 2026 Patch Tuesday update, was disclosed publicly with a proof-of-concept, and security firm watchTowr has confirmed active exploitation. Attackers use the stolen machine keys to forge authentication tokens, allowing them to regain access to compromised systems despite remediation efforts. The vulnerability affects on-premises SharePoint Server deployments, which are common in enterprise environments. Microsoft has released patches, but organizations that have not applied them or that have not rotated their machine keys remain at risk. The Hacker News and watchTowr both highlight the urgency of applying updates and rotating keys to mitigate the threat.

Global Impact

This vulnerability has significant economic and industry-specific consequences. Enterprises relying on SharePoint for document management and collaboration face potential data breaches, intellectual property theft, and operational disruption.