Microsoft's July Patch Tuesday fixed a critical flaw in on-premise SharePoint Server — CVE-2026-50522, rated 9.8 out of 10 — but the story didn't end there. Days after a security researcher published proof-of-concept exploit code on 20 July, monitoring firm watchTowr reported its honeypots were compromised within hours, and separate researchers had already spotted a quieter version of the attack in the wild since 17 July, before the patch even shipped.
The flaw is a deserialization bug: SharePoint's WS-Federation sign-in endpoint can be tricked into unpacking a malicious payload disguised as an ordinary authentication token, letting an attacker run code on the server without needing valid credentials first. What makes it worse than a typical "patch and move on" bug is what attackers are going after once they're in — SharePoint's machine keys, the cryptographic values the server uses to sign and validate its own authentication tokens. WatchTowr describes attackers pulling those keys with a single request. Once someone has them, they can forge valid-looking tokens and walk back in as any user, on any SharePoint site, at any time afterwards — even on a server that has since been patched, because the stolen keys themselves were never rotated.
This is a different bug from the SharePoint deserialization zero-day we covered on 18 July (CVE-2026-58644) and the trio patched on 16 July — SharePoint has had an unusually rough month, but this is a distinct flaw with its own CVE, affecting all supported on-premise versions (Subscription Edition, 2019, and 2016). SharePoint Online (Microsoft 365) is not affected.
What this means for your business
- Patching alone does not close this. If your on-premise SharePoint was exposed before you installed July's update, an attacker may already hold your machine keys — and those keep working after the patch is applied. The keys themselves need to be rotated, not just the software updated.
- This only applies to on-premise/self-hosted SharePoint Server — if your organisation uses SharePoint through Microsoft 365 (SharePoint Online), this specific issue does not affect you.
- Ask whoever manages your SharePoint server three things this week: is July's security update installed, has the server's machine keys been rotated since, and is there any sign of unusual sign-ins between 17 July and now.
- If you're not sure whether your SharePoint is on-premise or cloud-hosted, that's worth finding out today — it's the first question that determines whether any of this applies to you at all.
None of this needs to be handled alone in a panic; it needs one direct question to your IT provider about patch status and key rotation, this week.