Our automated tracking framework flagged that CISA added CVE-2026-50522 (Microsoft SharePoint) to the Known Exploited Vulnerabilities (KEV) catalog on July 24, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-50522 by July 25, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-50522 |
| Vendor / product | Microsoft SharePoint |
| Vulnerability | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability |
| CVSS base score | 9.8 |
| Added to KEV | July 22, 2026 |
| Days public before listing (NVD → KEV lag) | 8 |
| Federal patch deadline | July 25, 2026 |
| Known ransomware use | No |
How This Compares to Microsoft’s Track Record
This one was public for just 8 days before CISA confirmed exploitation — faster than Microsoft’s 567-day median, meaning attackers moved unusually quickly. Microsoft currently ranks #18 on our KEV Lag leaderboard.
| Microsoft in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 382 |
| Median lag (public → KEV listing) | 567 days |
| 0-day rate (exploited at or before disclosure) | 23% |
| Entries tied to known ransomware campaigns | 104 |
For perspective, the median across all 1653 tracked KEV entries is 274 days — Microsoft’s exploited vulnerabilities are flagged slower than the catalog average.
Other Recent Microsoft KEV Additions
The most recent Microsoft vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-58644 | SharePoint | July 16, 2026 | 2 | No |
| CVE-2026-56155 | Active Directory Federation Services | July 14, 2026 | 0 | No |
| CVE-2026-56164 | SharePoint Server | July 14, 2026 | 0 | No |
| CVE-2026-45659 | SharePoint Server | July 1, 2026 | 40 | No |
| CVE-2008-4250 | Windows | May 20, 2026 | 6418 | No |
What This Means for Defenders
A critical deserialization vulnerability in Microsoft SharePoint, CVE-2026-50522 (CVSS 9.8), has been added to CISA’s KEV catalog with an urgent federal patch deadline of July 25, 2026. This vulnerability allows for remote code execution, making it a high-priority threat. All organizations utilizing Microsoft SharePoint are exposed, but federal agencies and critical infrastructure entities must prioritize patching immediately due to the tight three-day remediation window imposed by CISA.
The vulnerability was public for only 8 days before its inclusion in the KEV catalog, indicating active and rapid exploitation. This short NVD-to-KEV lag, significantly less than Microsoft’s historical median of 567 days for KEV entries, suggests attackers likely developed exploits quickly after public disclosure, or even prior to it. While ransomware use isn’t confirmed, the severity and exploitability mean attackers are actively targeting unpatched systems.
Organizations unable to apply the patch before the deadline must implement robust compensating controls. This includes network segmentation to isolate SharePoint servers, strict access controls, continuous monitoring for unusual activity on SharePoint infrastructure, and application-layer firewalls to detect and block malicious deserialization attempts. Incident response plans should be ready for immediate activation given the high likelihood of exploitation.
Related Coverage
- SharePoint RCE Exploited; FortiBleed Linked to Ransomware
- Cisco Catalyst SD-WAN Zero-Day Actively Exploited for Months
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
