Critical SharePoint RCE flaw exploited to steal machine keys

Microsoft SharePoint CVE-2026-50522, a critical deserialization RCE, is being actively exploited in the wild: attackers are leveraging a publicly released proof-of-concept to achieve remote code execution on on-prem SharePoint servers and steal machine keys that allow forging authentication tokens and long-term access. Security firms watchTowr and Defused observed exploitation soon after the PoC publication; Microsoft issued patches in July and defenders are advised to patch and rotate exposed credentials.