Another SharePoint RCE exploited: Patch, then rotate your machine keys (CVE-2026-50522)

**Active exploitation of SharePoint RCE (CVE-2026-50522) observed:** Security firms (WatchTowr, Defused) report attackers are exploiting a critical unauthenticated SharePoint RCE to extract IIS machine keys for persistent access, with successful attempts recorded shortly after PoC release; Censys estimates ~1,500 on-prem SharePoint hosts potentially exposed. CISA and vendors urge rapid patching, AMSI enablement, hardening, intrustion hunts and rotation of IIS machine keys because patching alone may not evict attackers.