Four SharePoint Flaws Entered CISA's Catalogue in Twenty-Two Days — One Left a Single Working Day

CISA added a fourth Microsoft SharePoint vulnerability to its Known Exploited Vulnerabilities catalogue on 22 July, closing a month in which the product drew more entries than in any comparable stretch since the catalogue opened in 2021.

The entry, CVE-2026-50522, is a critical remote code execution flaw that Microsoft fixed in its 14 July update. Researchers at watchTowr recorded successful exploitation against internet-facing servers on 20 July, within hours of proof-of-concept code becoming public. Federal civilian agencies were given until 25 July to remediate.

A month of repeat entries

The four additions landed on 1, 14, 16 and 22 July. Four entries for one product in a single month is a spike for the whole catalogue. Our count of the CISA feed, version 2026.07.27, finds fourteen SharePoint entries in total going back to November 2021. Six arrived in 2026. Four of those six arrived in July.

Across the same month CISA made twenty-five additions in total, so SharePoint alone accounted for roughly one in six. The other three are CVE-2026-45659, CVE-2026-56164 and CVE-2026-58644 — a mix of deserialization, privilege elevation and an authenticated remote code execution issue that Microsoft had already patched in June.

The clocks each entry carried

Every one of the four came with a three-day remediation window. CISA counts those in calendar days, which means the weekday an entry lands decides how much working time a team actually gets.

Three of the four deadlines fell on a Saturday or Sunday. Worst was the 16 July entry — added Thursday, due Sunday, leaving Friday the 17th as the single working day.

This is the second July in a row

The pattern has a precedent, and it is exactly twelve months old. In July 2025 CISA added three SharePoint flaws in three days during the wave that came to be known as ToolShell.

The 2025 windows gave one calendar day each, but all of them landed on weekdays, so each still contained a working day. The 2026 windows are three times that on paper and produced the same floor of one working day, because three of the four deadlines fell on a weekend.

Then there is the concentration. Half of every SharePoint entry in the catalogue's history was added in July, across two consecutive years. Some of that is coincidence of disclosure timing, and some reflects that a widely deployed on-premises product with a large internet-facing estate attracts sustained attention once a working technique circulates.

Why the patch does not end it

What separates this from a routine patch cycle is what attackers took. watchTowr reported that operators exploiting CVE-2026-50522 are stealing IIS machine keys — the cryptographic material SharePoint uses to sign and validate authentication tokens.

An attacker holding those keys can mint valid tokens and return as a legitimate user, with access to the sites and documents that identity could reach. Because the keys are stolen before the fix goes on, applying the update does not evict anyone who already has them.

That is why the guidance does not stop at patching. Rotate machine keys, enable AMSI integration for each SharePoint web application, hunt for intrusion artefacts, and rotate credentials on any exposed asset. Patch-only remediation leaves the door open.

What the flaw is

CVE-2026-50522 is a deserialization-of-untrusted-data issue. Insufficient validation before deserializing user-supplied data allows an unauthenticated attacker to reach code execution over the network. It affects SharePoint Enterprise Server 2016, SharePoint Server 2019 and SharePoint Server Subscription Edition.

We have deliberately held the description there. Exploit code is public; defenders who need the mechanics to write detections will find them in the vendor research linked below.

How much is actually exposed

Censys counted roughly 1,500 self-managed, internet-facing SharePoint deployments, predominantly SharePoint 2019, with smaller numbers reporting 2016 and Subscription Edition. Most sit in the United States.

That figure covers on-premises installations only. SharePoint Online is not affected — a point the standard "SharePoint is under attack" headlines almost always miss.

The scheduling problem underneath

Three-day windows are now the norm rather than the exception. We reported earlier this month that the median remediation window in the catalogue collapsed from twenty-one days to three, and that the operational change ran ahead of the directive usually credited with it.

When windows were three weeks, the day of the week barely mattered. At three calendar days it is the difference between three working days and one — exactly the arithmetic our own first-party KEV deadline calculator exists to do.

The caveats

• KEV deadlines bind US federal civilian agencies. For everyone else the catalogue is a signal that a flaw is being exploited, not a legal obligation.
• Exploitation reports come from vendor telemetry. watchTowr's honeypot network saw attempts on 20 July; a separate service reported possible attempts on 17 July, before the PoC. Neither is a census of who has been hit.
• CVSS 9.8 is a severity score, not an exposure measure. It says nothing about whether a given server is reachable.
• Our working-day figures are arithmetic, not policy. CISA's deadline is the calendar date; the working-day column is our calculation of the time inside it.

Key takeaways

• Four SharePoint flaws entered the KEV catalogue between 1 and 22 July — four of the fourteen SharePoint entries CISA has ever listed.
• CVE-2026-50522 was exploited within hours of a public PoC, on 20 July, against internet-facing servers.
• Stolen machine keys outlive the patch. Rotation, not just updating, is what closes the access.
• Three of the four deadlines fell on a weekend, and one window contained a single working day.
• Around 1,500 self-managed servers are internet-facing; SharePoint Online is not affected.