Hackers are actively exploiting the critical **CVE-2026-50522** vulnerability in **Microsoft SharePoint** to steal machine keys and maintain access even after affected servers are patched. An attacker obtaining these keys can create valid authentication tokens to impersonate users and access available resources such as SharePoint sites and documents with the privileges of the forged identity. **Microsoft** describes the security issue as a deserialization-of-untrusted-data flaw that allows a remote attacker to execute code over a network without authentication. The flaw was addressed in July's security updates from **Microsoft**. It was not initially marked as actively exploited, but the advisory noted an increased likelihood of being leveraged. Offensive security company **watchTowr** has observed that hackers started to leverage **CVE-2026-50522** against on-premise vulnerable SharePoint deployments immediately after a valid proof-of-concept (PoC) exploit became public. “On July 20th, **watchTowr** identified proof-of-concept exploit code for this vulnerability,” **watchTowr** states. "Within hours, our global honeypot network, **Attacker Eye**, captured exploitation attempts using this PoC that successfully compromised target systems." The researchers note that the attackers are stealing machine keys that allow them to maintain long-term access on breached systems. Early warning threat intelligence company **Janggggg** also reported an undocumented SharePoint deserialization vector being used in attacks as early as July 17 but could not initially link the activity to a specific flaw. Yesterday, the company confirmed that the attacks were likely driven by exploiting the **CVE-2026-50522** SharePoint vulnerability. ### Exploit Released Publicly At least one PowerShell demonstrative exploit for **CVE-2026-50522** is available on **GitHub** from **Janggggg**. The PoC attempts to trigger remote code execution by delivering a malicious **.NET** 'BinaryFormatter' payload as the cookie of a forged 'SecurityContextToken' within a **WS-Federation** sign-in response posted to SharePoint's ‘/_trust/default.aspx’ endpoint. If the token is processed by a vulnerable deserialization path, the payload results in arbitrary code execution on the SharePoint server. It should be noted that **Janggggg** published the PoC on the same day **watchTowr** started to detect attacks leveraging it. However, it is unclear if the observed incidents made use of the publicly available exploit. While applying the latest SharePoint security updates removes the vulnerability, **watchTowr** advises defenders to also rotate credentials on any asset that may have been exposed.