What Happened
Hackers are actively exploiting CVE-2026-50522, a critical deserialization of untrusted data vulnerability in Microsoft SharePoint Server, to steal machine keys — and patching alone does not stop the attack from succeeding after the fact. The flaw carries a CVSS score of 9.8 and was patched by Microsoft on July 14 as part of the July Patch Tuesday release.
On July 20, watchTowr published a proof-of-concept for CVE-2026-50522. Within hours, their global honeypot network recorded successful exploitation attempts against target systems. Attackers are extracting SharePoint machine keys in a single HTTP request. Those keys allow an attacker to forge valid SharePoint authentication tokens, impersonate any user — including site administrators — and access SharePoint sites, document libraries, and stored content without further exploitation. Post-patch, the forged tokens remain valid unless machine keys are rotated.
This is the fourth SharePoint vulnerability confirmed exploited in the past month, following CVE-2026-58644, CVE-2026-45659, and CVE-2026-56164. The pattern reflects sustained attacker focus on on-premises SharePoint as a high-value target within enterprise and government environments.
Why This Matters for Canadian Organizations
SharePoint is embedded across Canadian federal and provincial government departments, municipalities, hospitals, universities, law firms, and financial institutions. On-premises SharePoint Server deployments — still prevalent in the public sector — are the primary attack target, as cloud-hosted SharePoint Online is not affected by this vulnerability.
The machine key theft vector makes this particularly serious. An attacker who extracted machine keys before a patch was applied retains authenticated access to the SharePoint environment indefinitely, even after the CVE-2026-50522 patch is installed. Organizations that patched on July 14 or later but did not immediately rotate machine keys on servers that were internet-exposed remain at risk of persistent unauthorized access.
Under PIPEDA, a breach involving personal data held in SharePoint triggers breach notification obligations to the Office of the Privacy Commissioner. Under OSFI Guideline B-13, federally regulated financial institutions must log, assess, and report this class of technology incident. Departments subject to the Treasury Board Directive on Security Management face similar disclosure requirements. The Canadian Centre for Cyber Security is expected to issue guidance on this active exploitation wave.
What to Do
Apply the July 14 SharePoint Server patches to all on-premises deployments — SharePoint Server 2016, 2019, and Subscription Edition — if not already done. Apply them now without waiting for a maintenance window.
Rotate SharePoint machine keys on all servers that were internet-facing or that had unpatched exposure after July 14. Rotating keys invalidates any forged tokens an attacker generated using stolen keys. Microsoft documentation on machine key rotation in SharePoint Server covers the required steps.
Audit authentication and access logs for anomalous activity: users accessing SharePoint from unexpected IP addresses, outside normal business hours, or accessing document libraries they do not normally use. Look for activity dating back to July 20, when the public proof-of-concept was released.
If exploitation is confirmed or suspected, activate your incident response plan, notify your CISO and legal team, and report to the CCCS at cyber.gc.ca.
Sources: BleepingComputer, The Hacker News, Help Net Security
