SharePoint RCE under active exploitation

This report describes two critical deserialization vulnerabilities in on-premises Microsoft SharePoint (CVE-2026-50522 and CVE-2026-58644) that can lead to remote code execution and other severe impacts (webshells, credential theft, persistence). CVE-2026-50522 has a 9.8 severity and is reported as under active exploitation; affected SharePoint Server versions and build numbers are listed along with available cumulative updates and mitigation recommendations (apply patches immediately and restrict access to approved devices).