On-Prem SharePoint Takeover With No Login — CVE-2026-50522 & More, Patch Now

Microsoft's "SharePoint Server," widely used for company intranets and document sharing, received two new server-takeover vulnerabilities in the July 2026 monthly update (Patch Tuesday) that can be exploited without any login. They are CVE-2026-50522 and CVE-2026-58644, both rated 9.8 out of 10 (severity "Critical"). No prior login and no user interaction are needed, and they can be triggered directly over the network — a step more dangerous than the similar hole found in May.

Just before this, in May 2026, SharePoint Server had another takeover flaw, CVE-2026-45659 (severity 8.8), which was then seen under active attack and added by the U.S. agency CISA to its "Known Exploited Vulnerabilities (KEV)" list. The same "data deserialization" takeover keeps appearing, back to back, within months. All of them affect the self-hosted on-premises SharePoint Server (2016 / 2019 / Subscription Edition); the cloud SharePoint Online (Microsoft 365) is not affected. Fixes are already available. If you run the on-premises edition, apply the July update right now.

Update (July 23, 2026): CVE-2026-50522 also confirmed exploited and added to CISA KEV

The situation has changed significantly for CVE-2026-50522 (severity 9.8), the unauthenticated remote code execution flaw previously described as having "no reports of exploitation." Right after a proof-of-concept (PoC) was published on July 20, 2026, real exploitation attempts were observed, and the U.S. agency CISA added it to its catalog of actively exploited vulnerabilities (KEV). Both July flaws (CVE-2026-50522 and CVE-2026-58644) are now confirmed exploited.

Of particular concern: after breaking in, attackers are stealing the "machine keys" (the cryptographic keys SharePoint uses internally). If these are stolen, attackers can forge valid credentials and maintain access even after you patch. So "just updating" is not enough — rotate the machine keys after applying the patch. Also, on internet-facing on-premises SharePoint Server, we strongly recommend checking for suspicious web shells or unfamiliar traffic.

Update (Jul 21, 2026): CVE-2026-58644 confirmed exploited and added to CISA KEV

For the unauthenticated remote code execution flaw in on-premises SharePoint Server, CVE-2026-58644 (severity 9.8), Microsoft updated its advisory on July 15, 2026 and raised the exploitation status to "Exploitation Detected." It was treated as not-yet-exploited when first published, then upgraded to actively exploited the next day. On top of that, the U.S. agency CISA added CVE-2026-58644 to its "Known Exploited Vulnerabilities (KEV)" list on July 16, 2026, ordering federal agencies to remediate by a deadline. With no login and no user interaction, simply sending crafted data can run malicious code on the server.

Affected products are SharePoint Server 2016 / 2019 / Subscription Edition; the cloud SharePoint Online is not affected. The fix is provided in the July 14, 2026 monthly update (the fixed build for each version or later). If your server is not yet patched, update it now. Because attacks are already being observed, deferring the update is dangerous. Past exploitation is also tracked on the catalog of actively exploited vulnerabilities (KEV).

The two July 2026 flaws: server takeover with no login

Start with the latest two, which are the top priority. Both work the same way, abusing how SharePoint "restores" received data with no safeguards (the mechanism is explained below). The decisive difference from the May flaw is that exploitation needs no login at all. The severity breakdown rates them "no prior privileges (PR:N)," "no user interaction (UI:N)," and "over the network (AV:N)," giving a near-maximum 9.8. As long as there's a network path that reaches SharePoint, an attacker holding not a single account can go after it directly.

CVE-2026-50522: unauthenticated code execution (severity 9.8)

Microsoft's description reads: "Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network." The fixed builds are SharePoint 2016 at 16.0.5561.1001 or later, 2019 at 16.0.10417.20175 or later, and Subscription Edition at 16.0.19725.20434 or later. Because this is fixed in the newest (highest) build among the three flaws, updating to at least this build resolves all three — the two July flaws and the May one.

CVE-2026-58644: the same mechanism, unauthenticated takeover (severity 9.8)

The other flaw, CVE-2026-58644, is also unauthenticated code execution via "deserialization of untrusted data" (CWE-502). Its description, severity (9.8), and conditions (no login, no interaction, over the network) match CVE-2026-50522. The fixed builds are SharePoint 2016 at 16.0.5556.1005 or later, 2019 at 16.0.10417.20153 or later, and Subscription Edition at 16.0.19725.20384 or later. Applying the CVE-2026-50522 fixed build above closes this one at the same time.

Which update (KB) goes on which edition is listed on each CVE's official Microsoft page. If in doubt, use one yardstick — "is my edition at or above the CVE-2026-50522 build in the table above?" — and you cover all three May/July flaws at once.

This July update does not fix only the two takeovers above. A hole that lets an attacker bypass SharePoint's authentication with no login (CVE-2026-55040, severity 9.1) and a privilege-escalation hole later confirmed to be under active attack (CVE-2026-56164) are closed by the same update. Their fixed builds are the same as the table above, so reaching the July build clears the related SharePoint holes together.

Who targets this, and why

For the two July flaws, the one to watch is an outside attacker who probes from anywhere that can reach SharePoint over the network, holding not a single account. Because no login is needed, a SharePoint exposed to the internet is an obvious target, and so is one reachable by anyone who has taken a single step into the internal network. May's CVE-2026-45659 at least required a low-privilege login; the July pair drops even that condition, widening the pool of possible attackers considerably.

What the attacker can then do is send crafted data to SharePoint and run their own program on the server, taking over the server itself. What should have been a window for reading and writing documents becomes control of an internal server.

Once a SharePoint server is taken over, the damage does not stop at documents. Confidential files and personal data, plus the connection credentials to other systems SharePoint links to, get pulled out and used as a foothold to reach deeper into the internal network. In fact, on-premises SharePoint has become a major entry point for ransomware attacks in recent years, so a takeover translates directly into organization-wide harm. That is why the update below should come first.

What SharePoint Server is, and how it differs from the cloud

SharePoint is a Microsoft product used as the foundation for internal document sharing, portal sites, and business apps. It is used for storing and sharing files and for building approval flows and team sites, and is deployed by many companies and government offices.

The key point is that SharePoint comes in two broad forms: the "SharePoint Server (on-premises)" you install on your own servers, and the "SharePoint Online (included in Microsoft 365)" you use on Microsoft's cloud. All three flaws (CVE-2026-50522 / 58644 / 45659) affect only the former, the on-premises edition; cloud SharePoint Online is not affected. Whether you run your own SharePoint servers or use the cloud via Microsoft 365 decides whether you need to act. First, confirm which one your organization uses.

The on-premises edition requires administrators to apply updates themselves, and because it sits at the center of operations and is hard to take offline, patching tends to be deferred. This "tendency to fall behind on updates" is a major reason it keeps being targeted.

What actually happens: the mechanism shared by all three

All three flaws stem from SharePoint "restoring" received data with no safeguards. In software, data is often frozen into a compact form to store or transmit, then restored to its original form (deserialization). If that restoring step trusts the incoming contents too much, an attacker can use crafted data to run arbitrary programs. What was abused here is exactly this "deserialization of untrusted data" (CWE-502).

The attacker sends crafted data to SharePoint and, at the moment the server restores it, runs their own program. Execution happens with SharePoint service privileges, so the attacker reaches the documents and data that server handles, and even the credentials for linked systems. The only difference is the "entry condition." July's CVE-2026-50522 and CVE-2026-58644 need no login at all (unauthenticated, 9.8), while May's CVE-2026-45659 needs a low-privilege login (8.8).

One note on May's CVE-2026-45659: some outlets reported it as "unauthenticated, CVSS 9.8," which is not accurate. The NVD (the U.S. NIST vulnerability database) rates it CVSS 8.8, and exploitation requires a low-privilege login. The two disclosed in July, by contrast, are rated unauthenticated and 9.8. The conditions differ per number, so don't conflate them.

Which ones are already being exploited

Just as important as the severity number is whether attacks are actually happening. Here the three diverge.

May's CVE-2026-45659 is already being exploited. Microsoft published the fix in the May monthly update, but attacks abusing this hole were later observed, and the U.S. agency CISA added it to its "Known Exploited Vulnerabilities (KEV)" list, which only carries items confirmed to be under real-world attack. Our Japanese-language tracking is collected in the CISA KEV dashboard (Japanese).

Of the two July takeovers, CVE-2026-58644 is already under active exploitation. Microsoft raised its exploitation status to "Exploitation Detected" on July 15, 2026, and CISA added it to KEV the next day. The other, CVE-2026-50522, has also seen real exploitation right after the July 20, 2026 PoC release and was added to CISA KEV (see the update at the top). It needs no login at all, and attackers steal machine keys to persist even after patching, so you must rotate the machine keys in addition to updating.

On top of that, another SharePoint hole in the July update, CVE-2026-56164, has been added to CISA's KEV (the list of vulnerabilities under real-world attack). That hole itself leads to privilege escalation; Microsoft rates it 5.3, but the NVD rates it 9.8 (Critical), so assessments diverge. But what matters is that attackers are actively going after SharePoint right now. Taken together with the two 9.8 takeovers and the unauthenticated auth-bypass CVE-2026-55040, the urgency of applying the July update is higher still. Reading "no takeover reports yet" as "no need to act" is dangerous; now, before exploitation spreads, is exactly the time to apply it.

Is your organization affected? A quick-reference table

First, confirm whether you run SharePoint servers yourself (the on-premises edition). If you only use SharePoint Online via Microsoft 365, none of these three require action. If you run on-premises, check whether you are at or above the "build that makes you safe" below. Reaching the July build (CVE-2026-50522) resolves all three, including the May flaw.

The fixes ship in the monthly updates, and Microsoft distributes update packages (KBs) for each edition. Which KB goes on which edition is on each CVE's official Microsoft page. You can check your own build number in the SharePoint Central Administration site or via PowerShell.

Background: why on-prem SharePoint keeps getting targeted

As the fact that three takeovers of the same type appeared within months shows, this is not a one-off accident. On-premises SharePoint is a product where "deserialization of untrusted data" takeovers (CWE-502) keep being found and have been used in large-scale attacks. In 2025, a chain of SharePoint flaws known as "ToolShell" was mass-exploited worldwide, and many organizations' servers were taken over. These three belong to the same "restore-step hole" lineage.

Why does it recur? Two structural reasons. One is technical: the "data restoring" SharePoint uses heavily internally is prone to becoming a weak point against crafted input. The other is operational: the on-premises edition requires each organization to apply updates by hand, and patches tend to slip because of the desire to avoid downtime. To an attacker, SharePoint — placed at the core of the organization, gathering high-value documents, and slow to update — is a cost-effective target.

The practical conclusion is simple. Treat on-premises SharePoint as "an asset that could be targeted at any time," and build a routine to apply monthly updates without delay. And in the longer term, moving to the cloud edition (SharePoint Online), where Microsoft handles the updates, is worth considering as an option.

What to do now

The top priority is to apply the July 2026 monthly update (the relevant KB) to on-premises SharePoint. Reaching the July build fixes all three at once, including CVE-2026-45659, which is already under attack from May. With an actively exploited hole still open, there is no room to defer on the grounds of testing. Apply it to every affected server as soon as possible.

Beyond updating, a few more checks are wise. First, confirm that the SharePoint server's antimalware integration (AMSI) is enabled; Microsoft recommends enabling AMSI as a defense against attacks that abuse the restore step. Second, if you expose SharePoint externally, review whether that exposure is truly necessary and restrict it to internal or approved parties only. Because the two July flaws are exploitable without login, simply narrowing what can reach it greatly reduces the risk. Finally, check whether you have already been breached: look for unfamiliar files (especially web-page parts such as .aspx), unknown administrator accounts or processes, and suspicious traffic, and if anything is doubtful, rotate credentials and run a deeper investigation.

Summary

In July 2026, on-premises SharePoint Server received two flaws that allow server takeover with no login (CVE-2026-50522 / CVE-2026-58644, both severity 9.8). They belong to the same "data restoring" lineage as CVE-2026-45659 (8.8, already in CISA KEV), found in May and already under attack — and the July pair is a step more dangerous because it needs no login at all. Moreover, July's CVE-2026-58644 was confirmed exploited soon after disclosure and added to CISA KEV. The affected editions are 2016 / 2019 / Subscription; the cloud SharePoint Online is not affected.

On-premises SharePoint is a product where restore-step takeovers keep recurring and delayed updates keep being exploited. The state of "the fix is out but not applied" is the biggest risk of all. First confirm whether you run the on-premises edition, and if so, apply the July monthly update now — reaching the July build resolves all three at once. And don't forget to review external exposure and check whether you have already been breached.

Sources

• ▸NVD - CVE-2026-50522 Detail (unauthenticated RCE, 9.8)
• ▸NVD - CVE-2026-58644 Detail (unauthenticated RCE, 9.8)
• ▸Microsoft Security Response Center - CVE-2026-50522 (official, fix KBs)
• ▸Microsoft Security Response Center - CVE-2026-58644 (official, fix KBs)
• ▸NVD - CVE-2026-45659 Detail (May flaw, exploited)
• ▸Microsoft Security Response Center - CVE-2026-45659 (official, fix KBs)
• ▸CISA - Known Exploited Vulnerabilities Catalog (KEV)
• ▸CISA - CVE-2026-58644 and others added to KEV (July 16, 2026)
• ▸Rapid7 - CVE-2026-58644 exploited in the wild (analysis)
• ▸Tenable - SharePoint exploitation FAQ (32201/45659/56164)
• ▸Related: CISA KEV dashboard (Japanese, this site)