Executive Threat Intelligence: Corporate Intranet & Document Farms Targeted

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency update to its Known Exploited Vulnerabilities (KEV) catalog, adding CVE-2026-50522, a critical remote code execution flaw in Microsoft SharePoint Server. Assigned a severity rating of CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), telemetry from global threat response centers confirms that advanced persistent threat (APT) groups and initial access brokers are actively exploiting on-premises and hybrid SharePoint deployments to compromise internal corporate networks.

SharePoint Server houses sensitive organizational intelligence, including proprietary documents, human resource records, financial plans, and board-level communications. Successful exploitation yields unconstrained code execution inside the Internet Information Services (IIS) worker process, enabling attackers to dump cryptographic machine keys, exfiltrate document libraries, and deploy web shells that withstand operating system restarts.

Vulnerability Mechanics & XML Deserialization Breakdown (CWE-502)

The vulnerability originates within the Business Data Connectivity (BDC) metadata administration endpoint, specifically in how the SharePoint service deserializes application definition packages passed via SOAP API calls:

The SharePoint BDC service allows administrators to import external system models defined in XML schema formats. During processing, the Microsoft.SharePoint.BusinessData.Parser.PackageParser class instantiates an unconstrained .NET XmlReader that fails to enforce strict type checking or disable dangerous object deserialization formatters. An unauthenticated attacker transmitting a crafted SOAP envelope containing an embedded System.Data.DataSet gadget payload can force the server to deserialize untrusted binary data: 

POST /_vti_bin/BDCMetadataService.svc HTTP/1.1
Host: sharepoint.corporate-intranet.com
Content-Type: application/soap+xml; charset=utf-8
SOAPAction: "http://schemas.microsoft.com/sharepoint/bdc/ImportPackage"

<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope">
  <soap:Body>
    <ImportPackage xmlns="http://schemas.microsoft.com/sharepoint/bdc">
      <packageXml>
        <Model xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Name="PayloadModel">
          <LobSystems>
            <LobSystem Name="ExploitSystem" Type="Custom">
              <LobSystemInstances>
                <LobSystemInstance Name="ExploitInstance">
                  <Properties>
                    <Property Name="SerializedGadget" Type="System.Data.DataSet">
                      <!-- Serialized Object Gadget Chain executing PowerShell payload -->
                      AAEAAAD/////AQAAAAAAAAAMAgAAAFBTeXN0ZW0uRGF0Y...
                    </Property>
                  </Properties>
                </LobSystemInstance>
              </LobSystemInstances>
            </LobSystem>
          </LobSystems>
        </Model>
      </packageXml>
    </ImportPackage>
  </soap:Body>
</soap:Envelope>

Upon deserialization, the payload triggers an immediate process execution inside the w3wp.exe worker process running under the high-privilege cAppPool identity. From this context, the attacker has unrestricted access to the underlying SharePoint configuration database, farm service passwords, and local filesystem.

Threat Actor Campaigns & Post-Exploitation Activity

Forensic telemetry demonstrates that adversaries conduct automated network scans targeting TCP ports 80, 443, and non-standard SharePoint administration ports (such as 8080, 8443, and 50000). Once remote execution is secured, threat actors execute a structured compromise playbook:

  • MachineKey Extraction: Threat actors dump the IIS machineKey (validation and decryption keys) from web.config, enabling them to forge ASP.NET ViewState tokens across any application hosted on the server.
  • Database Pivoting: Attackers utilize built-in SharePoint management assemblies to execute SQL queries directly against the Microsoft SQL Server back-end, exfiltrating document BLOBs and Active Directory synchronization databases.
  • Web Shell Implantation: Obfuscated .aspx web shells are injected into the /_layouts/15/ physical directory path (C:\\Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\16\\TEMPLATE\\LAYOUTS\\), ensuring persistent external command-and-control.

Affected Software Versions & Cumulative Updates

The following SharePoint Server editions are vulnerable until the corresponding Microsoft security update is deployed:

Product Release Supported Architecture Remediation Knowledge Base (KB) Severity
SharePoint Server 2016 Enterprise / Standard (x64) KB5002611 (Cumulative Update) Critical (CVSS 9.8)
SharePoint Server 2019 Enterprise / Standard (x64) KB5002615 (Cumulative Update) Critical (CVSS 9.8)
SharePoint Server Subscription Edition Version 22H2 / 23H1 / 24H1 KB5002620 (Cumulative Update) Critical (CVSS 9.8)

Defensive Playbook & Incident Response Checklist

Security teams maintaining SharePoint server infrastructure must execute the following remediation procedures:

1. Immediate Cumulative Update Installation

Install the relevant KB update across all Web Front End (WFE) and Application server roles, followed by executing the SharePoint Products Configuration Wizard (psconfig): 

# Run SharePoint Configuration Wizard to finalize database schema updates
PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures

2. Restrict SOAP and BDC Endpoints via Perimeter WAF

Configure Web Application Firewall (WAF) or IIS Request Filtering rules to block external access to BDC metadata endpoints from outside the internal network: 

# IIS URL Rewrite Rule to block public access to BDCMetadataService
<rule name="BlockBDCExternal" stopProcessing="true">
  <match url=".*BDCMetadataService.svc.*" />
  <conditions>
    <add input="{REMOTE_ADDR}" pattern="^(10.|172.(1[6-9]|2[0-9]|3[0-1]).|192.168.)" invert="true" />
  </conditions>
  <action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Endpoint Restricted" />
</rule>

3. Hunt for Rogue ASPX Shells in SharePoint Layouts

Execute PowerShell file-system auditing across the SharePoint hive directories to identify newly created or anomalous .aspx files: 

# Inspect SharePoint LAYOUTS directory for suspicious web shells
Get-ChildItem -Path "C:Program FilesCommon Filesmicrosoft sharedWeb Server Extensions*TEMPLATELAYOUTS" -Recurse -Filter "*.aspx" |
  Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-14) -or $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
  Select-Object FullName, CreationTime, LastWriteTime, Length