Critical SharePoint RCE CVE-2026-50522 Actively Exploited to Steal Machine Keys

Hackers are actively exploiting a critical remote code execution vulnerability in Microsoft SharePoint — CVE-2026-50522 — to steal ASP.NET machine keys from compromised servers. According to BleepingComputer, exploitation is already occurring in the wild, and the damage persists even after affected servers are patched.

What Happened

CVE-2026-50522 is a critical RCE flaw in Microsoft SharePoint. Attackers are not just using it to gain an initial foothold — they are specifically targeting the ASP.NET machine keys stored on vulnerable servers. Those keys are then weaponized to maintain access through a channel that survives the patch itself.

Why It Matters

ASP.NET machine keys are the cryptographic root of trust for SharePoint's web tier. They sign and validate ViewState, encrypt forms authentication cookies, and protect session data. An attacker who possesses your machine key can:

• Forge ViewState payloads that execute arbitrary code on any server in the farm sharing that key — no further vulnerability required
• Mint forms authentication tickets that impersonate any user, including site collection administrators
• Retain persistent access across reboots and patch cycles, because the stolen key — not the original CVE — is now the backdoor

This is the critical nuance: patching the RCE closes the initial entry point but does nothing to invalidate a machine key that was already exfiltrated. An organization that patches without rotating keys remains fully compromised.

SharePoint farms are high-value targets. They commonly integrate with Active Directory, hold sensitive internal documents, and run under service accounts with significant domain privileges. A compromised SharePoint server is rarely a dead end — it is a pivot point into the broader environment.

What To Do

1. Patch immediately. Apply Microsoft's fix for CVE-2026-50522. Check the Microsoft Security Response Center for affected versions and the correct cumulative update.

2. Rotate machine keys — this step is not optional. Patching without key rotation leaves you exposed to an attacker who already has your key. Generate new <machineKey> values and push updated web.config files to every server in your SharePoint farm. Restart IIS after deployment.

3. Assume breach if you have not patched yet. Review IIS and SharePoint ULS logs for anomalies: large POST bodies to /_vti_bin/ or /_layouts/ endpoints, unexpected HTTP 500 errors with ViewState content, or w3wp.exe spawning PowerShell or cmd.exe child processes.

4. Isolate internet-facing instances. If your SharePoint is reachable from outside your perimeter, treat this as an active incident — not a standard patch cycle.

5. Audit service account privileges. SharePoint application pool accounts frequently accumulate more rights than they need. Verify least privilege now, before any harvested credentials are used for lateral movement.

Active in-the-wild exploitation means the window for clean remediation is closing. Patch and key rotation should happen in parallel, not sequentially.