Fourth SharePoint Vulnerability Exploited in Past Month’s Wave of Attacks

CVE-2026-50522 is the latest SharePoint flaw in a concentrated campaign: SecurityWeek reports it as the fourth SharePoint vulnerability exploited in the past month’s wave of attacks. Threat actors are using it to steal machine keys and keep long-term access to compromised environments rather than one-off intrusion.

Machine keys underpin cryptographic operations that SharePoint relies on for session integrity and authentication-related material. Once those keys are taken, attackers can forge or reuse trusted material and stay inside the environment without repeatedly re-exploiting the original bug. The practical chain is exploit, key theft, then durable access that outlives the initial foothold.

For engineers and builders who run SharePoint, the risk is not only initial compromise but persistence after the hole is closed. Stolen machine keys can keep attackers effective even when the vulnerable path is patched or blocked, so incident response has to treat key material as compromised until it is rotated and related trust is re-established.

The broader market signal is that SharePoint remains a high-value target and that this campaign is multi-CVE, not a single one-off bug. A fourth exploited SharePoint issue in the same month’s wave points to operators iterating across related surfaces and techniques, which raises the cost of slow patch and detection cycles for organizations that treat each advisory in isolation.

Watch for whether defenders treat key theft as a first-class impact of CVE-2026-50522, not just as a remote code or auth bug, and whether follow-on guidance and tooling focus on detecting post-exploit key abuse and long-term access rather than only initial exploitation.