CVE-2026-50522: Remote Code Execution in Microsoft SharePoint Server via .NET Deserialization

HERMES

HERMES THREAT SCORE & ENTERPRISE COLLABORATION PLATFORM TAKEOVER

Target: Microsoft SharePoint Server (Subscription Edition, 2019, 2016)

Confidence: 99%

98 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 20 / 20

Weaponization 20 / 20

Exposure 19 / 20

Prevalence 20 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-50522 at 9.8 (Critical) and CVSS v4.0 scores 9.8. The Hermes Threat Score assigns 98 (CRITICAL). Alignment is definitive: Microsoft SharePoint on-premises houses critical corporate intellectual property, document vaults, and Active Directory service accounts. Deserialization allows attackers to run shellcode under the IIS worker process (w3wp.exe) and pivot into enterprise Active Directory domains.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-50522: Remote Code Execution in Microsoft SharePoint Server via .NET DeserializationVULNERABILITY

Connected Nodes: 3

Active Relationships (Outgoing)

→ affectsPRODUCTMicrosoft Windows & Windows Server

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Windows & Windows Server documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

→ usesATTACK TECHNIQUET1059: Command and Scripting Interpreter

90% VERY_HIGH

Adversaries abuse command and script interpreters (Bash, Python, PowerShell) to execute arbitrary commands.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1059.”

Supporting Verified Evidence:

• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

→ usesATTACK TECHNIQUET1552: Unsecured Credentials

90% VERY_HIGH

Adversaries search compromise victims for unsecured credentials in files, environment variables, or memory.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1552.”

Supporting Verified Evidence:

• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

CISA KEV Alert: Active In-the-Wild Exploitation

CVSS v3.1: 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) / CVSS v4.0: 9.8 Critical (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) / CWE-502: Deserialization of Untrusted Data. Cataloged in the CISA Known Exploited Vulnerabilities (KEV) Catalog. Affects Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.

Executive Summary

CVE-2026-50522 is a critical remote code execution vulnerability impacting Microsoft SharePoint Server on-premises deployments. The vulnerability resides in SharePoint’s Business Data Connectivity (BDC) and internal XML web services. When parsing serialized input streams, the server invokes legacy .NET deserialization formatters (BinaryFormatter / LosFormatter) without enforcing adequate type filtering via SerializationBinder.

An unauthenticated or low-privileged remote attacker can transmit a serialized .NET gadget payload within an HTTP request. Upon processing, the object graph instantiates arbitrary .NET classes, resulting in unconstrained code execution within the context of the IIS application pool account (w3wp.exe), leading to Active Directory domain credential harvesting and complete farm compromise.

---

1. Technical Context & Affected Software Matrix

SharePoint Server is widely deployed within on-premises government, defense, and healthcare environments for intranet collaboration and document repositories.

Parameter	Technical Specification	Threat Context
CVE Identifier	CVE-2026-50522	CISA KEV Catalog Entry
Vulnerable Component	Microsoft.SharePoint.dll (BDC Metadata Web Service)	.NET Remoting & Deserialization handler
Process Context	w3wp.exe (SharePoint Application Pool Identity)	Local administrative / Service Account privileges
Network Vector	HTTP/HTTPS (Port 80, 443, or custom web application ports)	Inbound web requests to SharePoint sites
Affected Versions	SharePoint Subscription Edition, 2019, 2016	On-premises enterprise server farms
Fixed Versions	Microsoft Security Update (August / September 2026)	Official Windows Update MSRC Release
Exploitation Impact	RCE in IIS worker, Active Directory ticket extraction	Complete server farm compromise

---

2. In-Depth Technical Decomposition: .NET Deserialization & Gadget Chains

A. The Insecure Deserializer Handler

The vulnerability exists in the BDC service endpoint that handles serialized model imports. When a client submits a payload containing serialized metadata structures, SharePoint attempts to deserialize the stream:

// Decompiled representation of vulnerable BDC deserialization routine
public static object DeserializeMetadataObject(byte[] serializedData) {
    MemoryStream ms = new MemoryStream(serializedData);
    BinaryFormatter formatter = new BinaryFormatter();
    // VULNERABILITY: No custom SerializationBinder attached to formatter
    return formatter.Deserialize(ms);
}

Because modern .NET object graphs support polymorphic type binding during deserialization, an attacker can craft a gadget chain leveraging standard classes in the Microsoft .NET framework (TypeConfuseDelegate, DataSet, or ActivitySurrogateSelector):

+----------------------------------------------------------------------------------------------------+
|                         CVE-2026-50522 DESERIALIZATION EXECUTION FLOW                              |
+----------------------------------------------------------------------------------------------------+

   [Remote Adversary]
          │
          │ [1] HTTP POST /_vti_bin/BDCMetadataService.svc
          │     SOAP Envelope with Base64 serialized BinaryFormatter payload
          ▼
   [Microsoft IIS / SharePoint Server (w3wp.exe)]
          │
          ├───► 1. SOAP Request Dispatcher:
          │     - Forwards payload to DeserializeMetadataObject()
          │
          ├───► 2. BinaryFormatter Deserialization:
          │     - Reconstructs malicious object graph
          │     - Triggers TypeConfuseDelegate / SortedSet comparator callbacks
          │
          ├───► 3. Arbitrary Method Invocation:
          │     - Invocator redirects execution to System.Diagnostics.Process.Start()
          │     - Parameters: "powershell.exe -enc <Base64Payload>"
          │
          ▼
   [Process Creation Under w3wp.exe]
          │
          └───► Spawns powershell.exe / cmd.exe:
                - Executes memory-injected C2 implant (e.g. Cobalt Strike / Brute Ratel)
                - Dumps DPAPI farm master keys and machine keys from web.config
                - Interacts with Microsoft SQL Server backend database
+----------------------------------------------------------------------------------------------------+

---

3. Threat Intelligence, CISA KEV & Exploitation in the Wild

• CISA KEV Addition: Added following active exploitation by advanced threat groups who chained CVE-2026-50522 with authentication bypasses to harvest sensitive intranet documentation.
• Weaponization Vector: Automated exploit toolkits weaponize ysoserial.net formatters to drop in-memory web shells (e.g. SharpSpool, .ashx memory-only handlers).
• Farm Lateral Movement: Attackers utilize compromised w3wp.exe identities to dump machine keys from web.config, allowing them to forge ASP.NET ViewState tokens across all server nodes in the SharePoint farm.

---

4. MITRE ATT&CK Mapping

Tactic	Technique ID	Technique Name	Exploitation Manifestation
Initial Access	T1190	Exploit Public-Facing Application	Remote HTTP POST with serialized payload to SharePoint endpoint
Execution	T1059.001	Command and Scripting Interpreter: PowerShell	Spawning powershell.exe from w3wp.exe
Defense Evasion	T1505.003	Server Software Component: Web Shell	Injecting memory-resident web shells into IIS application pool
Credential Access	T1552	Unsecured Credentials	Extracting SharePoint farm credentials and web.config machine keys

---

5. Detection Engineering & Telemetry

A. Suricata Detection Rule

alert http any any -> $SHAREPOINT_SERVERS any (
  msg:"HERMES DEFENSE - SharePoint .NET Deserialization Exploit Attempt (CVE-2026-50522)";
  flow:established,to_server;
  http.method; content:"POST";
  http.uri; content:".svc";
  http.request_body; content:"AAEAAAD///// ";
  classtype:web-application-attack;
  sid:202650522;
  rev:1;
  reference:cve,2026-50522;
)

B. Sigma Detection Rule

title: Suspicious Child Process Spawned by IIS w3wp.exe (SharePoint)
id: 4c3b2a1d-9e8f-7a6b-5c4d-50522c026e01
status: high
description: Detects suspicious child processes such as cmd.exe or powershell.exe spawned by SharePoint w3wp.exe worker processes.
author: Hermes Codex Detection Engineering
date: 2026-09-11
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\whoami.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare custom administrative scripts invoked directly via IIS (atypical).
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.001

---

6. Digital Forensics & Incident Response (DFIR)

Windows Incident Response Checklist:

1. Examine IIS Worker Telemetry:

   Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1} |
     Where-Object { $_.Message -match "w3wp.exe" -and $_.Message -match "(cmd|powershell)" }

2. Review IIS W3C Logs:
   • Look for high volume POST requests directed at /_vti_bin/BDCMetadataService.svc or *.svc returning HTTP 200 or 500 status codes.
3. Inspect ASP.NET Temporary Files:
   • Check C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\ for anomalous .dll compilation timestamps.

Hunting Query (Elasticsearch / OpenSearch):

{
  "query": {
    "bool": {
      "must": [
        { "term": { "process.parent.name": "w3wp.exe" } },
        {
          "terms": {
            "process.name": ["cmd.exe", "powershell.exe", "pwsh.exe", "whoami.exe"]
          }
        }
      ]
    }
  }
}

---

7. Mitigation & Remediation

1. Deploy Microsoft MSRC Security Update: Apply the latest SharePoint Server Security Updates immediately.
2. Enforce AMSI for SharePoint: Verify that Antimalware Scan Interface (AMSI) integration is enabled in SharePoint to inspect .NET deserialization buffers in memory.
3. Network Isolation: Ensure internal SharePoint servers are segregated from direct internet exposure; require reverse proxy authentication with pre-authentication inspection.
4. AppPool Identity Hardening: Run SharePoint Application Pools under managed service accounts (gMSA) with least privilege principles.

---

8. References & Advisories

• Microsoft Security Response Center (MSRC) Advisory
• CISA Known Exploited Vulnerabilities Catalog
• NIST NVD CVE-2026-50522 Detail
• OWASP Deserialization of Untrusted Data Prevention