CVE-2026-50522

Think of SharePoint as a building that receives messages from the internet. This flaw is like a “mailbox” that can be tricked into opening and acting on malicious instructions instead of treating the message as data. That can let an attacker take control of the server and disrupt your business.

This matters if you run Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition for your company. The issue is reachable over the network and does not require a login or user action. The risk is highest when the vulnerable SharePoint endpoints are reachable from the internet (or otherwise accessible to untrusted parties).

This should be treated as RED urgency because it is a remote code execution flaw: attackers can send crafted network data that causes arbitrary code execution, without needing authentication. Even though there’s no confirmed public exploit code or clear dated exploitation reports in the findings, the combination of remote reachability and no-login requirement makes patching the safest move now.

1. Identify your SharePoint edition and build

• Determine whether you run Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition.
• Record the exact currently installed SharePoint build number.

2. Determine whether you’re vulnerable

• Compare your build against the fixed versions from the patch findings:
  • Enterprise Server 2016: fixed in 16.0.5561.1001
  • Server 2019: fixed in 16.0.10417.20175
  • Subscription Edition: fixed in 16.0.19725.20434
• If your build is older than the fixed build for your edition, you should assume exposure.

3. Upgrade to the fixed build

• Upgrade SharePoint to the fixed version matching your edition (use the exact build numbers above).
• Plan for normal patching steps: take backups/snapshots as your process requires, schedule downtime if needed, and ensure the patch is applied successfully.

4. Verify after installation

• Confirm the installed SharePoint build matches the fixed version for your edition.
• Confirm SharePoint services start correctly and that key sites/pages and search (if applicable) work as expected.

5. If you cannot patch immediately (temporary risk reduction)

• Restrict network access to SharePoint so it is not reachable from untrusted networks (for example, limit inbound access to known corporate IPs / approved reverse proxies / VPN users).
• Review firewall/proxy/WAF rules to ensure only necessary traffic reaches SharePoint.

6. What to monitor

• After patching, monitor SharePoint and web/application logs for unusual requests that resemble exploit attempts (unexpected serialized-data patterns, spikes in 4xx/5xx around the same endpoints, or repeated requests from the same external IPs).

CISA KEV note

• This CVE is not listed in the CISA KEV set per the findings, so prioritize it based on severity and exposure rather than KEV status.

CVE-2026-50522 is classified as Remote Code Execution (CWE-502 is unsafe deserialization). The mechanism described in the findings is remote code execution by sending crafted serialized data over the network. The findings state no authentication and no user interaction are required. The flaw condition includes that untrusted data deserialization is enabled in SharePoint.

Exploitation/availability context from findings:

• CISA KEV: not listed.
• Public exploit code: none on record in the findings.
• Real-world exploitation reports: no clear dated claim and no articles stating exploitation in the findings.
• Patch status: fixed builds are provided for SharePoint Enterprise Server 2016 (16.0.5561.1001), SharePoint Server 2019 (16.0.10417.20175), and SharePoint Server Subscription Edition (16.0.19725.20434).

Why it’s severe:

• If reachable, an attacker can deliver malicious serialized payloads that are deserialized by SharePoint in a way that permits arbitrary code execution, leading to complete compromise potential (server control and downstream data impact).