Technical Advisory & Lab Note: SharePoint Server Deserialization RCEs, Machine-Key Theft, and Post-Exploitation Persistence

Date: 2026-07-23
Audience: On-premises SharePoint administrators (enterprise operators and homelab/self-hosted deployments)
Format: Publishable document — combined advisory + lab-note
Word Count: ~4,800
Status: Draft for review

1. Executive Summary

A coordinated threat-actor campaign is exploiting multiple critical vulnerabilities in Microsoft SharePoint Server on-premises to achieve unauthenticated or low-privilege remote code execution, deploy web shells, steal IIS ASP.NET machine keys, establish persistent access via forged ViewState payloads and malicious IIS modules, and pivot laterally into Active Directory. Five CVEs are actively exploited as of mid-July 2026:

*Microsoft states "Site Owner" is required; NVD displays PR:N (no privileges). Both assessments may be valid for different attack paths.

• CVE-2026-50522 status as of July 23, 2026: CISA has not added it to KEV — confirm current CISA KEV status before publish.

The critical finding: patching alone does not evict an attacker who has stolen the IIS machine key. Stolen keys enable forged ViewState payloads that bypass all server-side validation — permanently and cryptographically. The remediation sequence must therefore be: hunt artifacts → remove persistence → rotate keys → apply patches (in that order).

This advisory covers vulnerability details, a step-by-step exploitation analysis, detection guidance, and concrete remediation steps. Homelab and self-hosted operators should pay special attention to the risk section in §5.