CISA Adds Actively Exploited SharePoint Flaw CVE-2026-50522 to KEV

CISA has added CVE-2026-50522 to its Known Exploited Vulnerabilities catalog. The entry, dated 2026-07-22, covers a deserialization of untrusted data vulnerability in Microsoft SharePoint that could allow an unauthorized attacker to execute code over a network.

CISA catalogs the SharePoint vulnerability as actively exploited. The flaw is listed under Microsoft SharePoint and tied to CWE-502. It was added to the KEV catalog on 2026-07-22 with a federal remediation due date of 2026-07-25.

Whether the vulnerability is known to be used in ransomware campaigns remains unknown according to the catalog entry.

Required actions focus on vendor mitigations and BOD 26-04 compliance. Stakeholders must apply mitigations in accordance with vendor instructions. This includes ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s Forensics Triage Requirements.

For cloud services, organizations must follow applicable BOD 26-04 guidance. If mitigations are unavailable, they must discontinue use of the product.

Asset exposure evaluation is mandated for all stakeholders. Stakeholders are responsible for evaluating each asset's internet exposure. They must ensure adherence to BOD 26-04 patching guidelines.

The catalog entry provides links to the BOD 26-04 and Forensics Triage Requirements documents in its additional notes. Federal agencies have three days from the addition date to complete required remediation.