# SharePoint RCE flaws exploited in the wild

Published: 2026-07-22 · Severity: critical · Sectors: technology, government-national
Canonical: https://vorant.io/reports/e99df3d3-aaf6-5c5c-bbb7-c635f321c7fd/sharepoint-rce-flaws-exploited-in-the-wild

> Two critical unauthenticated remote code execution flaws in Microsoft SharePoint are being actively exploited, prompting CERT-FR to urge immediate patching and secret rotation.

Microsoft's July 2026 monthly update addressed two critical SharePoint vulnerabilities, CVE-2026-50522 and CVE-2026-58644, both allowing unauthenticated remote code execution. Microsoft confirmed active exploitation of CVE-2026-58644 in its advisory, while security firm watchTowr reported on July 21, 2026 that a public proof-of-concept and active exploitation also exist for CVE-2026-50522. Affected products include SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, all prior to specific patched builds.

CERT-FR is urging organizations to apply the vendor patches immediately given the unauthenticated RCE nature of both flaws and confirmed in-the-wild exploitation. Notably, the agency warns that if compromise is suspected, patching alone is insufficient — attackers who have stolen ASP.NET machine keys can persist and regain access even after updates are applied, necessitating full secret rotation including machine keys. This pattern mirrors prior SharePoint exploitation campaigns (referenced CERTFR-2025-ALE-010) where stolen cryptographic material enabled long-term persistence.

## Mentioned in this report

- Vulnerabilities: CVE-2026-50522 (KEV), CVE-2026-58644 (KEV)

## Detection guidance (public sample)

### SharePoint IIS Worker Process Spawning Command Shell

ATT&CK: T1190

Detects w3wp.exe running under the SharePoint application pool spawning cmd.exe or powershell.exe, consistent with post-exploitation of unauthenticated RCE vulnerabilities such as CVE-2026-50522/CVE-2026-58644. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SharePoint IIS Worker Process Spawning Command Shell
description: Detects the SharePoint IIS worker process (w3wp.exe) spawning a command
  interpreter, a strong indicator of successful exploitation of an unauthenticated
  RCE against SharePoint (e.g. CVE-2026-50522, CVE-2026-58644). Generalises on the
  parent/child process relationship rather than any specific payload or PoC artefact.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    Image|endswith: \w3wp.exe
    ParentCommandLine|contains: SharePoint
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  filter_common_admin:
    CommandLine|contains:
    - Get-Help
    - -NonInteractive -Command Get
  condition: selection_parent and selection_child and not filter_common_admin
falsepositives:
- SharePoint farm administration scripts that intentionally shell out from the application
  pool identity (rare)
- Third-party SharePoint monitoring agents hosted in-process
level: high
id: 2d350a0f-eaa5-5e10-b661-6f4da1a195d4
status: experimental
author: Vorant
```

### Suspicious Extraction or Use of ASP.NET Machine Key Material

ATT&CK: T1552

Detects command-line activity referencing ASP.NET machineKey validation/decryption key material or ViewState-forging tooling (e.g. ysoserial.net), consistent with attackers reusing stolen machine keys for persistent RCE after a SharePoint exploitation as warned by CERT-FR. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Extraction or Use of ASP.NET Machine Key Material
description: Detects processes referencing machineKey validationKey/decryptionKey
  values or ViewState deserialization/forging tooling on a SharePoint host. Attackers
  who steal ASP.NET machine keys during initial RCE exploitation can forge ViewState
  payloads to regain unauthenticated code execution even after patching, unless keys
  are rotated. Rule targets the distinctive command-line pattern of key material handling/forging
  tools rather than any single sample hash or path.
tags:
- attack.credential-access
- attack.t1552
logsource:
  category: process_creation
  product: windows
detection:
  selection_keywords:
    CommandLine|contains:
    - validationKey
    - decryptionKey
    - MachineKeySection
    - ysoserial
  selection_sharepoint_context:
  - Image|endswith: \w3wp.exe
  - CommandLine|contains: SharePoint
  - ParentCommandLine|contains: SharePoint
  condition: selection_keywords and selection_sharepoint_context
falsepositives:
- Legitimate administrators rotating machine keys as part of incident response or
  scheduled key rollover
- Developers debugging ViewState/MAC validation issues on a SharePoint or ASP.NET
  test farm
level: high
id: 329cbaa2-edbd-5694-b579-58a6586f8715
status: experimental
author: Vorant
```

### New ASPX File Written Under SharePoint Layouts or ISAPI Directory by IIS Worker Process

ATT&CK: T1190

Detects the SharePoint w3wp.exe process writing a new .aspx file into web-accessible SharePoint directories, indicating a webshell dropped as a result of successful unauthenticated RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: New ASPX File Written Under SharePoint Layouts or ISAPI Directory by IIS Worker
  Process
description: Detects w3wp.exe (the SharePoint application pool worker process) creating
  a new .aspx file inside SharePoint's web-accessible TEMPLATE/LAYOUTS or ISAPI directories.
  Legitimate SharePoint operation does not write new .aspx pages into these paths
  at runtime; this behaviour is typical of webshell deployment following exploitation
  of an unauthenticated RCE vulnerability.
tags:
- attack.persistence
- attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \w3wp.exe
    TargetFilename|endswith: .aspx
    TargetFilename|contains:
    - \TEMPLATE\LAYOUTS\
    - \ISAPI\
  filter_deployment:
    TargetFilename|contains: \SharePoint\ADMIN\
  condition: selection and not filter_deployment
falsepositives:
- SharePoint solution package (WSP) deployment or farm upgrade jobs writing new layout
  pages
- Custom SharePoint development or feature activation on a dev/test farm
level: high
id: 774bb05b-9439-5368-92a0-972a839e809c
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-008

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e99df3d3-aaf6-5c5c-bbb7-c635f321c7fd/sharepoint-rce-flaws-exploited-in-the-wild.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup