{"id":"CVE-2026-50522","kind":"vulnerability","aliases":["CVE-2026-50522"],"related":[],"title":"microsoft sharepoint server: Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code…","description":"WAF Release - 2026-08-04 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nAugust 4, 2026\n\n## WAF Release - 2026-08-04\n\nThis release introduces new rules and updates Microsoft SharePoint RCE alongside enhanced SSRF cloud protection rule actions.\n\nKey Findings\n\n- CVE-2026-50522: An insecure deserialization vulnerability in Microsoft SharePoint Server. This may allow an unauthenticated attacker to execute arbitrary code using crafted requests.\n- CVE-2026-66066: An improper input processing vulnerability in Ruby on Rails Active Storage image variant transformations. This may allow an unauthenticated attacker to perform arbitrary file reads and achieve Remote Code Execution (RCE) using maliciously crafted payload requests.\n- Generic Cloud Protections: Added improved detection logic targeting Server-Side Request Forgery (SSRF) in cloud-hosted applications.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...052b07cf | N/A | Microsoft SharePoint - Remote Code Execution - CVE:CVE-2026-50522 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...3a5b40d6 | N/A | Rails - Arbitrary File Read & RCE - CVE:CVE-2026-66066 | Block | Block | This was labeled as File Upload - RCE. |\n| Cloudflare Managed Ruleset | ...743a63ec | N/A | SSRF - Local - 2 - Beta | Disabled | - | This detection has been removed. |\n| Cloudflare Managed Ruleset | ...c2e84e2d | N/A | SSRF - Cloud - Beta | Disabled | - | This detection has been removed. |\n| Cloudflare Managed Ruleset | ...ab8af26f | N/A | SSRF - Cloud - 2 - Beta | Disabled | - | This detection has been removed. |\n| Cloudflare Managed Ruleset | ...25ba9d7c | N/A | SSRF - Cloud | Disabled | Block | We are changing the action for this rule from Disabled to BLOCK |\n| Cloudflare Managed Ruleset | ...01a076eb | N/A | SSRF - Local - Beta | Disabled | - | This detection has been removed. |","summary":"Microsoft SharePoint has a deserialization of untrusted data flaw that lets an unauthenticated attacker over the network run code on the server. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-07-22T00:00:00+00:00","products":[{"name":"Microsoft SharePoint","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft sharepoint server","fixed":["16.0.19725.20434"],"affected":"< 16.0.19725.20434","ecosystem":"vendor"},{"name":"microsoft sharepoint server","fixed":[],"affected":"= 2016","ecosystem":"vendor"},{"name":"microsoft sharepoint server","fixed":[],"affected":"= 2019","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cloudflare","exploited","lab-disclosure","microsoft","on-prem","self-hosted","sharepoint","vendor"],"not_affected_if":["managed-hosting","sharepoint-online"],"how_to_check":null,"fix":"Apply the Microsoft mitigation or patch for CVE-2026-50522 per vendor instructions; the sources do not name a fixed version. Follow CISA BOD 26-04 guidance, or discontinue use of SharePoint if mitigations are unavailable.","status":"open","published_at":"2026-07-14T17:17:01+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:33:33+00:00","updated_at":"2026-10-24T18:43:45+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T20:33:33Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft mitigation or patch for CVE-2026-50522 per vendor instructions; the sources do not name a fixed version. Follow CISA BOD 26-04 guidance, or discontinue use of SharePoint if mitigations are unavailable.","summary":"Microsoft SharePoint has a deserialization of untrusted data flaw that lets an unauthenticated attacker over the network run code on the server. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["sharepoint","microsoft","self-hosted","on-prem"],"confidence":0.7,"analyst_note":"Find the Microsoft advisory for CVE-2026-50522 to get affected and fixed build numbers, the exact mitigation, and whether SharePoint Online is affected; sources only give the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["sharepoint-online","managed-hosting"],"severity_if_unknown":"critical"},"cost_usd":0.000395,"input_tokens":2199,"output_tokens":350,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':85C,101C '-08':84C,100C '-2026':20A,23A,122C,146C,227C,248C '-50522':21A,24A,123C,228C '-66066':147C,249C '01a076eb':327C '052b07cf':218C '2':266C,295C '2026':83C,96C,99C '25ba9d7c':306C '3a5b40d6':239C '4':95C '743a63ec':262C 'ab8af26f':291C 'achiev':174C 'action':118C,211C,213C,316C 'activ':76B,157C 'add':187C 'allow':12A,134C,164C 'alongsid':112C 'applic':202C 'arbitrari':140C,170C,242C 'attack':15A,63B,137C,167C 'august':94C 'beta':267C,281C,296C,331C 'block':230C,250C,251C,311C,323C 'c2e84e2d':277C 'chang':314C 'changelog':86C,87C 'cisa':72B 'cloud':115C,185C,200C,280C,294C,309C 'cloud-host':199C 'cloudflar':36B,93C,215C,236C,259C,274C,288C,303C,324C 'code':18A,68B,141C,176C,223C 'comment':214C 'craft':143C,181C 'cve':19A,22A,121C,145C,225C,226C,246C,247C 'data':7A,57B 'descript':209C 'deseri':4A,54B,126C 'detect':189C,235C,270C,284C,299C,334C 'disabl':268C,282C,297C,310C,321C,332C 'disclosur':40B 'enhanc':113C 'execut':17A,139C,177C,224C 'exploit':37B,77B 'file':171C,243C,256C 'find':120C 'flaw':58B 'forgeri':196C 'generic':184C 'host':47B,201C 'id':205C,208C 'imag':159C 'improp':149C 'improv':91C,188C 'input':150C 'insecur':125C 'introduc':104C 'key':119C 'lab':39B 'lab-disclosur':38B 'label':254C 'legaci':206C 'let':60B 'list':73B 'local':265C,330C 'log':229C 'logic':190C 'malici':180C 'manag':216C,237C,260C,275C,289C,304C,325C 'may':133C,163C 'microsoft':1A,9A,25A,27A,30A,33A,41B,50B,109C,129C,220C 'n/a':219C,240C,263C,278C,292C,307C,328C 'network':66B 'new':88C,105C,212C,234C 'offic':10A 'on-prem':42B 'payload':182C 'perform':169C 'prem':44B 'previous':210C 'process':151C 'protect':116C,186C 'rail':156C,241C 'rce':111C,178C,245C,258C 'read':172C,244C 'releas':82C,98C,103C 'remot':175C,222C 'remov':273C,287C,302C,337C 'request':144C,183C,195C 'rubi':154C 'rule':106C,117C,204C,207C,319C 'ruleset':203C,217C,238C,261C,276C,290C,305C,326C 'run':67B 'self':46B 'self-host':45B 'server':3A,29A,32A,35A,71B,131C,193C 'server-sid':192C 'sharepoint':2A,11A,26A,28A,31A,34A,48B,51B,110C,130C,221C 'side':194C 'ssrf':114C,197C,264C,279C,293C,308C,329C 'storag':158C 'target':191C 'transform':161C 'unauthent':62B,136C,166C 'unauthor':14A 'untrust':6A,56B 'updat':89C,108C 'upload':257C 'use':142C,179C 'variant':160C 'vendor':49B 'vulner':127C,152C 'waf':81C,97C 'wild':80B","nicknames":[],"mitigations":[{"kind":"waf-rule","scope":null,"since":"2026-08-04","covers":"HTTP requests proxied through Cloudflare matched by the Cloudflare Managed Ruleset rule 'Microsoft SharePoint - Remote Code Execution - CVE:CVE-2026-50522' (action changed from Log to Block)","limits":"Only traffic proxied through Cloudflare; the document does not state other limits.","source":"https://developers.cloudflare.com/changelog/post/2026-08-04-waf-release/","vendor":"Cloudflare","seen_at":"2026-10-24T18:42:15Z","confidence":0.9,"source_title":"WAF Release - 2026-08-04 · Changelog","customer_action":"none stated beyond enabling the Cloudflare Managed Ruleset; the upstream SharePoint fix is not described in this document"}],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-14T17:17:01+00:00","kev":{"dateAdded":"2026-07-22","dueDate":"2026-07-25","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-50522","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-50522","severity":null,"published_at":"2026-07-22T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-50522","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50522","severity":null,"published_at":"2026-07-14T17:17:01+00:00","modified_at":"2026-07-23T15:44:10+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null},{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-08-04-waf-release/#CVE-2026-50522","url":"https://developers.cloudflare.com/changelog/post/2026-08-04-waf-release/","severity":null,"published_at":"2026-08-04T18:42:13+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:43:45+00:00","fetched_at":"2026-10-24T18:43:45+00:00","note":"Cloudflare: WAF Release - 2026-08-04 · Changelog"}],"documents":[{"id":2874,"url":"https://developers.cloudflare.com/changelog/post/2026-08-04-waf-release/","title":"Cloudflare: WAF Release - 2026-08-04 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-08-04 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nAugust 4, 2026\n\n## WAF Release - 2026-08-04\n\nThis release introduces new rules and updates Microsoft SharePoint RCE alongside enhanced SSRF cloud protection rule actions.\n\nKey Findings\n\n- CVE-2026-50522: An insecure deserialization vulnerability in Microsoft SharePoint Server. This may allow an unauthenticated attacker to execute arbitrary code using crafted requests.\n- CVE-2026-66066: An improper input processing vulnerability in Ruby on Rails Active Storage image variant transformations. This may allow an unauthenticated attacker to perform arbitrary file reads and achieve Remote Code Execution (RCE) using maliciously crafted payload requests.\n- Generic Cloud Protections: Added improved detection logic targeting Server-Side Request Forgery (SSRF) in cloud-hosted applications.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...052b07cf | N/A | Microsoft SharePoint - Remote Code Execution - CVE:CVE-2026-50522 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...3a5b40d6 | N/A | Rails - Arbitrary File Read & RCE - CVE:CVE-2026-66066 | Block | Block | This was labeled as File Upload - RCE. |\n| Cloudflare Managed Ruleset | ...743a63ec | N/A | SSRF - Local - 2 - Beta | Disabled | - | This detection has been removed. |\n| Cloudflare Managed Ruleset | ...c2e84e2d | N/A | SSRF - Cloud - Beta | Disabled | - | This detection has been removed. |\n| Cloudflare Managed Ruleset | ...ab8af26f | N/A | SSRF - Cloud - 2 - Beta | Disabled | - | This detection has been removed. |\n| Cloudflare Managed Ruleset | ...25ba9d7c | N/A | SSRF - Cloud | Disabled | Block | We are changing the action for this rule from Disabled to BLOCK |\n| Cloudflare Managed Ruleset | ...01a076eb | N/A | SSRF - Local - Beta | Disabled | - | This detection has been removed. |","published_at":"2026-08-04T18:42:13+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}