CVE-2026-50522

KEV Critical · CVSS 9.8

Microsoft Office SharePoint — Deserialization of untrusted data RCE

CVSS: 9.8; nvd
EPSS: 21.0%; 97th pct
KEV: Listed; 2026-07-22
Class: other; CWE-502

Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Search profile — drives PoC discovery

Symbols CWE-502deserializationSharePointuntrusted dataremote code executionnetwork attack

Keywords CVE-2026-50522SharePoint deserialization RCEMicrosoft SharePoint untrusted dataSharePoint remote code executionSharePoint CWE-502 exploitSharePoint deserialization PoC

Versions: <UNKNOWN>

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

harryhaxor/CVE-2025-53770-SharePoint-Deserialization-RCE-PoC needs review

gh_search

★ 1

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-15T18:00:20.000Z · profiled 2026-07-15T18:30:20.000Z