---
id: "CVE-2026-50522"
kind: "vulnerability"
aliases: ["CVE-2026-50522"]
title: "microsoft sharepoint server: Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Microsoft SharePoint", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "microsoft sharepoint server", "fixed": ["16.0.19725.20434"], "affected": "< 16.0.19725.20434", "ecosystem": "vendor"}, {"name": "microsoft sharepoint server", "fixed": [], "affected": "= 2016", "ecosystem": "vendor"}, {"name": "microsoft sharepoint server", "fixed": [], "affected": "= 2019", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cloudflare", "exploited", "lab-disclosure", "microsoft", "on-prem", "self-hosted", "sharepoint", "vendor"]
not_affected_if: ["managed-hosting", "sharepoint-online"]
published_at: "2026-07-14T17:17:01+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T18:43:45+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-50522", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50522", "first_seen_at": "2026-10-23T23:44:51+00:00"}, {"source": "lab", "url": "https://developers.cloudflare.com/changelog/post/2026-08-04-waf-release/", "first_seen_at": "2026-10-24T18:43:45+00:00"}]
---

# microsoft sharepoint server: Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code…

Microsoft SharePoint has a deserialization of untrusted data flaw that lets an unauthenticated attacker over the network run code on the server. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft SharePoint affected ? fixed ?
- vendor:microsoft sharepoint server affected < 16.0.19725.20434 fixed 16.0.19725.20434
- vendor:microsoft sharepoint server affected = 2016 fixed ?
- vendor:microsoft sharepoint server affected = 2019 fixed ?

## Fix

Apply the Microsoft mitigation or patch for CVE-2026-50522 per vendor instructions; the sources do not name a fixed version. Follow CISA BOD 26-04 guidance, or discontinue use of SharePoint if mitigations are unavailable.

## Mitigated for you by

- Cloudflare (waf-rule, since 2026-08-04): covers HTTP requests proxied through Cloudflare matched by the Cloudflare Managed Ruleset rule 'Microsoft SharePoint - Remote Code Execution - CVE:CVE-2026-50522' (action changed from Log to Block) Limits: Only traffic proxied through Cloudflare; the document does not state other limits. Still: none stated beyond enabling the Cloudflare Managed Ruleset; the upstream SharePoint fix is not described in this document https://developers.cloudflare.com/changelog/post/2026-08-04-waf-release/

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-50522
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-50522
- 2026-10-24T18:43:45+00:00 lab https://developers.cloudflare.com/changelog/post/2026-08-04-waf-release/ — Cloudflare: WAF Release - 2026-08-04 · Changelog

## Documents

- [advisory] Cloudflare: WAF Release - 2026-08-04 · Changelog https://developers.cloudflare.com/changelog/post/2026-08-04-waf-release/

## From the sources

WAF Release - 2026-08-04 · Changelog

# Changelog

New updates and improvements at Cloudflare.

August 4, 2026

## WAF Release - 2026-08-04

This release introduces new rules and updates Microsoft SharePoint RCE alongside enhanced SSRF cloud protection rule actions.

Key Findings

- CVE-2026-50522: An insecure deserialization vulnerability in Microsoft SharePoint Server. This may allow an unauthenticated attacker to execute arbitrary code using crafted requests.
- CVE-2026-66066: An improper input processing vulnerability in Ruby on Rails Active Storage image variant transformations. This may allow an unauthenticated attacker to perform arbitrary file reads and achieve Remote Code Execution (RCE) using maliciously crafted payload requests.
- Generic Cloud Protections: Added improved detection logic targeting Server-Side Request Forgery (SSRF) in cloud-hosted applications.

| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
| --- | --- | --- | --- | --- | --- | --- |
| Cloudflare Managed Ruleset | ...052b07cf | N/A | Microsoft SharePoint - Remote Code Execution - CVE:CVE-2026-50522 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...3a5b40d6 | N/A | Rails - Arbitrary File Read & RCE - CVE:CVE-2026-66066 | Block | Block | This was labeled as File Upload - RCE. |
| Cloudflare Managed Ruleset | ...743a63ec | N/A | SSRF - Local - 2 - Beta | Disabled | - | This detection has been removed. |
| Cloudflare Managed Ruleset | ...c2e84e2d | N/A | SSRF - Cloud - Beta | Disabled | - | This detection has been removed. |
| Cloudflare Managed Ruleset | ...ab8af26f | N/A | SSRF - Cloud - 2 - Beta | Disabled | - | This detection has been removed. |
| Cloudflare Managed Ruleset | ...25ba9d7c | N/A | SSRF - Cloud | Disabled | Block | We are changing the action for this rule from Disabled to BLOCK |
| Cloudflare Managed Ruleset | ...01a076eb | N/A | SSRF - Local - Beta | Disabled | - | This detection has been removed. |

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_