CVE · Exploited · On CISA KEV

CVE-2026-50522

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

9.8: CVSS 3.1
1: story
JUL 22: added to KEV

Severity: 9.8 Critical · vendor score
Vendor: Microsoft
Product: SharePoint
Published: Jul 14, 2026
Added to KEV: Jul 22, 2026
KEV deadline: Jul 25, 2026
Ransomware use: Unknown
Weakness: CWE-502

What it is

Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑

JUL 21
VulnerabilitiesCritical SharePoint Bug Under AttackThe flaw (CVE-2026-50522) affects SharePoint Enterprise Server 2016 and 2019 as well as SharePoint Subscription service. Microsoft released the fix for this vulnerability on July 14.DENNIS FISHER · 1 MIN

Official references

4 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record RegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Fixmsrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522