Third SharePoint Flaw From July Patch Batch Is Now Being Attacked

Key points

• Microsoft patched CVE-2026-50522, a critical SharePoint Server flaw, in its July 2026 Patch Tuesday release.
• The bug carries a CVSS severity score of 9.8 out of 10 and lets an unauthenticated attacker run code over the network.
• Security firm watchTowr confirmed the flaw is now being actively exploited in the wild.
• This is the third SharePoint bug from the same July 2026 patch batch to come under attack.
• Microsoft credited Taiwanese research firm DEVCORE with reporting the vulnerability.

Microsoft patched a nasty SharePoint bug in July. Attackers are now using it.

The flaw, tracked as CVE-2026-50522, sits in Microsoft SharePoint Server, the software many companies run on their own networks to host internal documents, staff intranets and team sites. It scored 9.8 out of 10 on the standard severity scale, which puts it in the "drop everything and patch" bracket.

Security firm watchTowr says the bug is being actively exploited. It is the third vulnerability from Microsoft's July 2026 Patch Tuesday, the company's monthly security fix release, to be turned into a live attack against SharePoint.

What can an attacker actually do with this bug?

Quite a lot, and without needing a password.

The flaw is what engineers call a deserialization bug. In plain terms: SharePoint accepts a chunk of data from the network and unpacks it without checking it properly. A hacker can hide instructions inside that data, and SharePoint runs them.

Because no login is required, and because the attack works over the network, a criminal only needs to reach the SharePoint server to take it over. On a corporate network, that usually means full access to internal documents, staff credentials, and any system the SharePoint server can talk to.

Microsoft credited DEVCORE, a Taiwanese offensive security research firm, with reporting the issue.

Why is this the third SharePoint bug in a row?

SharePoint has had a rough year. As The Hacker News noted, two other flaws from the same July batch were already being exploited before this one joined them.

That pattern is not a coincidence. When one bug in a product gets attention, researchers and attackers both dig into the surrounding code. Weaknesses that look similar often turn up nearby. A public proof-of-concept, which is example attack code shared online to demonstrate a flaw, tends to shorten the gap between "patch released" and "servers being hit" from weeks to days.

For CVE-2026-50522, that gap has closed.

Who has jurisdiction if data walks out?

SharePoint holds the kind of material regulators care about: HR files, customer records, contracts, health data in some sectors. If an exploited server leaks personal information, notification duties kick in fast.

In the United States, the Federal Trade Commission and state attorneys general handle consumer data exposure, with sector rules layered on top (HIPAA for health, GLBA for finance). In the United Kingdom, the Information Commissioner's Office requires notification within 72 hours of a company becoming aware of a personal data breach. Australian organisations answer to the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme. EU organisations report to their national data protection authority under GDPR.

None of these regulators accept "we knew about the patch but hadn't got to it" as a good answer.

What should affected organisations do now?

Apply Microsoft's July 2026 SharePoint update immediately if you have not already. Then assume the server may have been touched before you patched.

Check SharePoint logs for unusual requests to serialization endpoints, review any new or modified files in the web root, and rotate service account credentials the SharePoint server uses. If you find signs of intrusion, treat it as a data incident and start the clock on your notification duties.

Customers and employees of breached organisations should watch for notification letters, keep an eye on accounts that reuse work passwords, and be sceptical of any email that references internal documents or projects unexpectedly.