CISA Adds CVE-2026-50522 to KEV List Amid Exploitation Evidence

## Overview CISA added CVE-2026-50522 to its Known Exploited Vulnerabilities (KEV) list on July 22, 2026. This vulnerability affects Microsoft SharePoint and has a CVSS score of 9.8, indicating critical severity. The addition to the KEV list signals an urgent need for organizations to address this issue due to evidence of active exploitation. ## Technical Details CVE-2026-50522 involves a deserialization of untrusted data vulnerability. Attackers can exploit this flaw to execute arbitrary code over a network. The vulnerability arises when SharePoint improperly handles untrusted data during the deserialization process. This can allow an unauthorized attacker to gain control of affected systems remotely. ## Impact Successful exploitation of CVE-2026-50522 can lead to severe consequences, including unauthorized access to sensitive information and full system compromise. Organizations using affected versions of SharePoint are at risk of data breaches and operational disruptions. The potential for widespread exploitation makes this vulnerability particularly concerning for federal agencies and private sector organizations alike. ## Mitigation Defenders should prioritize applying patches released by Microsoft for SharePoint. Regularly updating systems and monitoring for unusual activity can help mitigate risks. Organizations should also review their security policies and ensure that proper access controls are in place to limit exposure to this vulnerability. Immediate action is crucial to protect against potential exploitation.