CVE-2026-50522: Microsoft SharePoint RCE Exploited to Steal Machine Keys

A critical security vulnerability in Microsoft SharePoint, tracked as CVE-2026-50522, is being actively exploited in the wild. Microsoft and security researchers have confirmed that threat actors are leveraging this Remote Code Execution (RCE) flaw to not only compromise servers but to steal cryptographic machine keys.

This specific attack vector poses a severe risk to enterprise integrity. Because the machine keys are used to encrypt and authenticate viewstate and forms authentication tickets, their theft allows attackers to maintain persistence and access to the SharePoint environment—potentially forging valid session tokens—even after the underlying vulnerability has been patched. For defenders, this means that standard patch management cycles are no longer sufficient; a compromise assessment and cryptographic rotation must follow any patch deployment immediately.

Technical Analysis

Vulnerability: CVE-2026-50522 Affected Product: Microsoft SharePoint Server (Subscription Edition, 2019, 2016) Attack Vector: Remote Code Execution (RCE) via unauthenticated network request Severity: Critical (CVSS 9.8 estimated)

The Attack Chain

Initial Exploitation: The attacker sends a specially crafted malicious request to the target SharePoint server. This request triggers the RCE vulnerability, allowing the attacker to execute code in the context of the SharePoint IIS worker process (w3wp.exe).
Privilege Escalation & Access: The code execution grants the attacker privileges consistent with the SharePoint Application Pool identity, typically Network Service or a specific service account.
Theft of Machine Keys: The attacker reads the machineKey configuration stored in the web.config file or the .NET machine-level configuration. In ASP.NET applications, these keys are used for encryption and signing of authentication cookies and viewstate.
Golden Ticket/Persistence: With the decryption and validation keys, the attacker can forge their own ASP.NET authentication cookies or decrypt valid traffic. This allows them to re-access the application as a privileged user without needing the RCE exploit again.
Survival Post-Patch: Even if the server is patched to block the RCE, the stolen keys remain valid until manually rotated. The attacker retains unauthorized access.

Exploitation Status

Status: Confirmed Active Exploitation
Source: Public reporting indicates active scanning and exploitation attempts are ongoing. This is not theoretical; active campaigns are targeting exposed SharePoint endpoints.

Detection & Response

Given the active exploitation, defenders must hunt for signs of compromise related to w3wp.exe activity and configuration access. Simply relying on vulnerability scanning is insufficient.

SIGMA Rules

YAML

---
title: SharePoint RCE - Suspicious Child Process of W3WP
id: 8c5a9b12-1d3f-4e5c-9f8a-2b3c4d5e6f7g
status: experimental
description: Detects potential code execution exploitation of SharePoint via suspicious child processes spawned by the IIS worker process.
references:
 - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/22
tags:
 - attack.initial_access
 - attack.t1190
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   ParentImage|endswith: '\w3wp.exe'
   Image|endswith:
     - '\powershell.exe'
     - '\cmd.exe'
     - '\pwsh.exe'
     - '\cscript.exe'
     - '\wscript.exe'
 filter:
   CommandLine|contains: 'AppPool' 
falsepositives:
 - Authorized administrative debugging
level: high
---
title: SharePoint - MachineKey Configuration Access
id: 9d6b0c23-2e4g-5f6d-0g1b-3c4d5e6f7g8h
status: experimental
description: Detects unusual processes attempting to read machine.config or web.config files where machine keys are stored.
references:
 - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/04/22
tags:
 - attack.credential_access
 - attack.t1005
logsource:
 category: file_access
 product: windows
detection:
 selection:
   TargetFilename|contains:
     - '\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config'
     - '\web.config'
   Image|notcontains:
     - '\System32\inetsrv\'
     - '\Program Files\Common Files\microsoft shared\Web Server Extensions\'
 condition: selection
falsepositives:
 - Legitimate backup tools or configuration management agents
level: medium

KQL (Microsoft Sentinel / Defender)

This query hunts for the IIS worker process spawning command shells, a strong indicator of successful RCE.

KQL — Microsoft Sentinel / Defender

DeviceProcessEvents
| where InitiatingProcessFileName == "w3wp.exe"
| where FileName in~ ("powershell.exe", "cmd.exe", "pwsh.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

Velociraptor VQL

Hunt for suspicious processes parented by the SharePoint worker process.

VQL — Velociraptor

-- Hunt for suspicious processes spawned by w3wp.exe
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, Parent.Pid AS ParentPid, Parent.Name AS ParentName
FROM pslist()
WHERE Parent.Name =~ "w3wp.exe"
  AND Name =~ "(cmd|powershell|pwsh|cscript|wscript)"

Remediation Script (PowerShell)

This script verifies the current SharePoint build version and, if a compromise is suspected, assists in identifying locations where Machine Keys must be rotated. Note: Patching alone does not secure this environment if keys were stolen.

PowerShell

# Check SharePoint Build Version and Identify Machine Key Locations
Write-Host "[+] Checking SharePoint Build Version..." -ForegroundColor Cyan
$ builds = Get-SPFarm | Select-Object -ExpandProperty BuildVersion
Write-Host "Current Farm Build Version: $builds" -ForegroundColor Yellow

# Compare against advisory baseline (Check Microsoft Security Advisory for CVE-2026-50522 safe baseline)
$Baseline = "16.0.18000.00000" # Placeholder for actual fixed version
if ($builds -lt $Baseline) {
    Write-Host "[!] ALERT: SharePoint build is below the patched baseline for CVE-2026-50522." -ForegroundColor Red
} else {
    Write-Host "[*] Build version appears patched." -ForegroundColor Green
}

Write-Host "[+] Auditing Machine Key configuration files..." -ForegroundColor Cyan
$ConfigPaths = @(
    "$env:WINDIR\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config",
    "$env:WINDIR\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config"
)

foreach ($path in $ConfigPaths) {
    if (Test-Path $path) {
        $acl = Get-Acl $path
        Write-Host "Permissions on $path:" -ForegroundColor White
        $acl.Access | Format-Table IdentityReference, FileSystemRights, AccessControlType -AutoSize
        
        # Check for recent modification which might indicate tampering
        $lastMod = (Get-Item $path).LastWriteTime
        if ((Get-Date) - $lastMod -lt (New-TimeSpan -Days 30)) {
            Write-Host "[!] WARNING: $path was modified in the last 30 days." -ForegroundColor Red
        }
    }
}

Write-Host "[+] REMEDIATION ACTION REQUIRED:" -ForegroundColor Magenta
Write-Host "1. Install the cumulative update for CVE-2026-50522 immediately."
Write-Host "2. If exploitation is suspected, you MUST generate new Machine Keys."
Write-Host "   Open IIS Manager -> Server Level -> Machine Key."
Write-Host "   Click 'Generate Keys' for both ValidationKey and DecryptionKey."
Write-Host "   Apply changes to root web.config and propagate to all SharePoint Web Applications."
Write-Host "   Perform an IISRESET (iisreset /noforce) after changing keys."

Remediation

Patch Immediately: Apply the latest Cumulative Update (CU) for Microsoft SharePoint that addresses CVE-2026-50522. Refer to the official Microsoft Security Advisory for the specific update numbers relevant to your SharePoint version (2016, 2019, or Subscription Edition).
Cryptographic Rotation (CRITICAL): Simply patching the code execution flaw does not evict an attacker who has already stolen the machine keys.
- Access the IIS Manager on all SharePoint Web Front Ends.
- Navigate to the Server Level -> Machine Key section.
- Manually generate new keys for Validation Key and Decryption Key.
- Update the web.config files accordingly.
- Perform an iisreset to ensure new keys are loaded.
- Note: This will invalidate all existing current ASP.NET sessions, forcing users to re-authenticate.
Investigation: Assume breach if your servers were exposed prior to patching. Hunt for evidence of w3wp.exe spawning unauthorized processes or unusual machine.config access timestamps.
Network Hygiene: Ensure SharePoint servers are not directly exposed to the public internet without a WAF configured to inspect inbound traffic for anomaly patterns associated with this vulnerability.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub