The Cipher

Last week's Patch Tuesday gave defenders a list of fixes. Attackers, apparently, got a shopping list. CVE-2026-50522 — a critical deserialization flaw in Microsoft SharePoint Server with a CVSS score of 9.8 — has moved from patched-but-theoretical to actively exploited in the wild, according to researchers at watchTowr. An unauthenticated attacker can send a crafted request across the network and execute arbitrary code on the server. No credentials required.

The vulnerability was originally credited to DEVCORE in Microsoft's July 2026 Patch Tuesday release. That disclosure was barely a week ago. The speed from patch to active exploitation is uncomfortable, but it isn't surprising — and that's the real story here.

When a vendor ships a fix, the diff between old and new code is essentially a treasure map. Researchers, defenders, and attackers all read the same patch notes. The difference is what they do next. For attackers, reverse-engineering a patch into a working exploit has become a near-automated exercise. The window defenders once had — days, maybe a week or two — has collapsed. One piece published today frames this precisely: N-day exploitation is becoming N-hour exploitation.

For SharePoint specifically, the stakes are high. SharePoint Server sits at the centre of countless enterprise intranets, document workflows, and identity integrations. It's the kind of system that has sensitive files from every corner of an organisation, and it's often exposed to internal networks in ways that make lateral movement trivial once an attacker is in. Notably, this is the third SharePoint vulnerability from the same July Patch Tuesday to come under active exploitation — a sign that attackers are systematically working through the same patch batch.

What defenders should do right now: If you haven't applied the July 2026 Patch Tuesday updates to SharePoint Server, stop reading and go do that. If you have, verify it. Patch deployment and patch confirmation are not the same thing. Network-level controls that restrict unauthenticated access to SharePoint from unexpected network segments are worth reviewing, and perimeter logging should be checked for anomalous POST requests to SharePoint endpoints.

Australian organisations running SharePoint on-premises — including government agencies, universities, and large enterprises — should treat this as high priority. ACSC's advisories have consistently flagged SharePoint as a high-value target for both financially motivated and nation-state actors, and the SOCI Act's incident notification obligations are worth having front-of-mind if a compromise is discovered. Cloud-hosted SharePoint (via Microsoft 365) is not directly affected by this specific vulnerability, but any organisation running the on-prem version should act today.

What to watch: watchTowr is the group that surfaced the active exploitation; expect more technical detail from them shortly. Microsoft's threat intelligence team has been unusually active this month — if they publish a formal exploitation notice, that will tell us whether this is opportunistic scanning or something more targeted. Either way, the window for safe inaction has already closed.