SharePoint RCE flaws exploited in the wild
Two critical unauthenticated remote code execution flaws in Microsoft SharePoint are being actively exploited, prompting CERT-FR to urge immediate patching and secret rotation.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-50522 and CVE-2026-58644 as exploited in the wild.
Microsoft's July 2026 monthly update addressed two critical SharePoint vulnerabilities, CVE-2026-50522 and CVE-2026-58644, both allowing unauthenticated remote code execution. Microsoft confirmed active exploitation of CVE-2026-58644 in its advisory, while security firm watchTowr reported on July 21, 2026 that a public proof-of-concept and active exploitation also exist for CVE-2026-50522. Affected products include SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, all prior to specific patched builds.
CERT-FR is urging organizations to apply the vendor patches immediately given the unauthenticated RCE nature of both flaws and confirmed in-the-wild exploitation. Notably, the agency warns that if compromise is suspected, patching alone is insufficient — attackers who have stolen ASP.NET machine keys can persist and regain access even after updates are applied, necessitating full secret rotation including machine keys. This pattern mirrors prior SharePoint exploitation campaigns (referenced CERTFR-2025-ALE-010) where stolen cryptographic material enabled long-term persistence.
Mentioned in this report
Detection guidance
SharePoint IIS Worker Process Spawning Command Shell
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects w3wp.exe running under the SharePoint application pool spawning cmd.exe or powershell.exe, consistent with post-exploitation of unauthenticated RCE vulnerabilities such as CVE-2026-50522/CVE-2026-58644. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SharePoint IIS Worker Process Spawning Command Shell
description: Detects the SharePoint IIS worker process (w3wp.exe) spawning a command
interpreter, a strong indicator of successful exploitation of an unauthenticated
RCE against SharePoint (e.g. CVE-2026-50522, CVE-2026-58644). Generalises on the
parent/child process relationship rather than any specific payload or PoC artefact.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
Image|endswith: \w3wp.exe
ParentCommandLine|contains: SharePoint
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
filter_common_admin:
CommandLine|contains:
- Get-Help
- -NonInteractive -Command Get
condition: selection_parent and selection_child and not filter_common_admin
falsepositives:
- SharePoint farm administration scripts that intentionally shell out from the application
pool identity (rare)
- Third-party SharePoint monitoring agents hosted in-process
level: high
id: 2d350a0f-eaa5-5e10-b661-6f4da1a195d4
status: experimental
author: Vorant
Suspicious Extraction or Use of ASP.NET Machine Key Material
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects command-line activity referencing ASP.NET machineKey validation/decryption key material or ViewState-forging tooling (e.g. ysoserial.net), consistent with attackers reusing stolen machine keys for persistent RCE after a SharePoint exploitation as warned by CERT-FR. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Extraction or Use of ASP.NET Machine Key Material
description: Detects processes referencing machineKey validationKey/decryptionKey
values or ViewState deserialization/forging tooling on a SharePoint host. Attackers
who steal ASP.NET machine keys during initial RCE exploitation can forge ViewState
payloads to regain unauthenticated code execution even after patching, unless keys
are rotated. Rule targets the distinctive command-line pattern of key material handling/forging
tools rather than any single sample hash or path.
tags:
- attack.credential-access
- attack.t1552
logsource:
category: process_creation
product: windows
detection:
selection_keywords:
CommandLine|contains:
- validationKey
- decryptionKey
- MachineKeySection
- ysoserial
selection_sharepoint_context:
- Image|endswith: \w3wp.exe
- CommandLine|contains: SharePoint
- ParentCommandLine|contains: SharePoint
condition: selection_keywords and selection_sharepoint_context
falsepositives:
- Legitimate administrators rotating machine keys as part of incident response or
scheduled key rollover
- Developers debugging ViewState/MAC validation issues on a SharePoint or ASP.NET
test farm
level: high
id: 329cbaa2-edbd-5694-b579-58a6586f8715
status: experimental
author: Vorant
New ASPX File Written Under SharePoint Layouts or ISAPI Directory by IIS Worker Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects the SharePoint w3wp.exe process writing a new .aspx file into web-accessible SharePoint directories, indicating a webshell dropped as a result of successful unauthenticated RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: New ASPX File Written Under SharePoint Layouts or ISAPI Directory by IIS Worker
Process
description: Detects w3wp.exe (the SharePoint application pool worker process) creating
a new .aspx file inside SharePoint's web-accessible TEMPLATE/LAYOUTS or ISAPI directories.
Legitimate SharePoint operation does not write new .aspx pages into these paths
at runtime; this behaviour is typical of webshell deployment following exploitation
of an unauthenticated RCE vulnerability.
tags:
- attack.persistence
- attack.t1190
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith: \w3wp.exe
TargetFilename|endswith: .aspx
TargetFilename|contains:
- \TEMPLATE\LAYOUTS\
- \ISAPI\
filter_deployment:
TargetFilename|contains: \SharePoint\ADMIN\
condition: selection and not filter_deployment
falsepositives:
- SharePoint solution package (WSP) deployment or farm upgrade jobs writing new layout
pages
- Custom SharePoint development or feature activation on a dev/test farm
level: high
id: 774bb05b-9439-5368-92a0-972a839e809c
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-008
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs