Microsoft SharePoint bug can let attackers run code remotely
A flaw in Microsoft SharePoint lets attackers send a specially crafted file to your site, which can run their own code on your server. This can let them steal data, take over accounts, or spread malware.
- Severity
- CriticalCVSS 3.1 · 9.8
- Fix
- Fixed in 16.0.19725.20434Fix recorded on Aug 26, 2026
- Affected versions
- 16.0.0 to before 16.0.5561.1001; 16.0.0 to before 16.0.10417.20175; 16.0.0 to before 16.0.19725.20434
- Weakness
- CWE-502Deserialization of Untrusted Data
- Exploit likelihood
- 85% in 30 daysEPSS, higher than 100% of known flaws
- Affects
- Microsoft SharePoint Enterprise Server 2016+2 more
- Exploited
- Yes, in the wildListed by CISA
- Added to CISA list
- Jul 22, 2026
- Federal fix deadline
- Jul 25, 2026
How it works
- An attacker sends a malicious file to SharePoint that tricks the server into running code it shouldn't.
- This happens when SharePoint tries to open untrusted files without properly checking them first.
What to do
Check whether the installed sharepoint server version is older than 16.0.19725.20434.
Update sharepoint server to 16.0.19725.20434 or newer. Then verify the installed version.
Technical details
Affected software: Microsoft SharePoint Enterprise Server 2016by Microsoft, Microsoft SharePoint Server 2019by Microsoft, Microsoft SharePoint Server Subscription Editionby Microsoft
CVE-2026-50522 is a CWE-502 deserialization of untrusted data flaw in Microsoft Office SharePoint. Microsoft rates it critical with a CVSS base score of 9.8, and describes it as allowing an unauthorized, unauthenticated attacker to execute code over a network. No further technical detail, affected version range, or proof-of-concept has been published beyond the MSRC and NVD advisory text.
Severity breakdown
- Attack vector Network Requires network access to the vulnerable service
- Attack complexity Low Low complexity under the assessed conditions
- Privileges required None Attacker needs no account or login
- User interaction None No victim action needed
- Scope Unchanged Impact stays within the same security authority
- Confidentiality impact High Sensitive data can be exposed with serious impact
- Integrity impact High Protected data can be changed with serious impact
- Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculatorReferences
- msrc.microsoft.com · CVE-2026-50522 Patch Vendor Advisory
- cisa.gov · known-exploited-vulnerabilities-catalog US Government Resource
- thehackernews.com · unc6671-vishing-attacks-target-personal.html TheHackerNews
- thehackernews.com · deadlock-ransomware-uses-polygon-smart.html TheHackerNews
- securityonline.info · unc6671-vishing-extortion-rebrand SecurityOnline
- neuracybintel.com · levi-strauss-confirms-social-engineering-attack-that-allowed-hackers-to-steal-corporate-data-from-employee-computers NeuraCybIntel
- neuracybintel.com · rising-sextortion-scams-exploit-massive-data-leaks-from-shinyhunters-group NeuraCybIntel