CVE-2026-50522

CVE-2026-50522 is a remote code execution flaw in Microsoft SharePoint that carries a CVSS score of 9.8 and affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. What moves this out of routine patch territory is confirmed exploitation: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-07-22, and its EPSS score of 57 percent puts it among the more likely-to-be-attacked entries in any given cycle. Because SharePoint on-premises servers commonly hold document libraries, service accounts, and connections into Active Directory, code execution here is a foothold into internal data rather than a contained web bug. No ransomware operator has been tied to it yet, but confirmed active use plus an on-premises attack surface is the pattern that precedes broader campaigns, so absence of ransomware attribution should not lower your urgency. Note that Microsoft SharePoint Online and other cloud-hosted collaboration are not in the affected list you provided; this read applies to the three on-premises editions named.

Do this: Identify every on-premises SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition instance you run, including forgotten test and archive farms, and apply Microsoft's update for CVE-2026-50522 on those hosts on the CISA KEV timeline for confirmed-exploited bugs. Verify the fix reached the actual SharePoint binaries and not just the OS, then hunt for prior compromise given exploitation was confirmed as of 2026-07-22: review IIS and SharePoint ULS logs for unexpected requests, look for new or modified web shells and unexpected w3wp child processes, and audit SharePoint and connected service accounts for credential misuse. Where immediate patching is not possible, restrict inbound access to SharePoint web front ends and prioritize internet-facing farms first.

AI-generated from public data, 2026-07-26. Verify against the vendor advisory before acting.