AI Security AI安全 2h ago Updated 1h ago 更新于 1小时前 42

Fourth SharePoint Vulnerability Exploited in Past Month’s Wave of Attacks 过去一个月内第四次SharePoint漏洞遭利用

CVE-2026-50522 is a critical remote code execution vulnerability in Microsoft SharePoint caused by the deserialization of untrusted data. The flaw was actively exploited in the wild before its patch release on July 14, with threat actors stealing machine keys to maintain persistent access. This marks the fourth SharePoint vulnerability exploited in the wild within a single month, highlighting a severe surge in targeted attacks. Security firms Defused and WatchTowr confirmed active exploitation, Microsoft修复了SharePoint关键远程代码执行漏洞CVE-2026-50522,该漏洞源于不受信任数据的反序列化。 威胁情报机构Defused和WatchTowr确认该漏洞已在野外被利用,攻击者旨在窃取机器密钥以维持长期访问权限。 这是过去一个月内发现的第四个在野利用的SharePoint漏洞,凸显了该平台近期面临的高频安全威胁。 仅打补丁不足以应对风险,防御者必须轮换任何可能暴露资产的凭据,因为攻击者可通过单次请求提取密钥。

65
Hot 热度
60
Quality 质量
55
Impact 影响力

Analysis 深度分析

TL;DR

  • CVE-2026-50522 is a critical remote code execution vulnerability in Microsoft SharePoint caused by the deserialization of untrusted data.
  • The flaw was actively exploited in the wild before its patch release on July 14, with threat actors stealing machine keys to maintain persistent access.
  • This marks the fourth SharePoint vulnerability exploited in the wild within a single month, highlighting a severe surge in targeted attacks.
  • Security firms Defused and WatchTowr confirmed active exploitation, noting that attackers use single requests to extract sensitive machine keys.
  • Immediate remediation requires not only applying Microsoft patches but also rotating credentials on potentially compromised assets.

Why It Matters

This incident underscores the critical risk of deserialization flaws in enterprise collaboration platforms, demonstrating how quickly unpatched vulnerabilities can be weaponized for persistent access. For AI and IT practitioners, it highlights the necessity of moving beyond simple patching to include proactive credential rotation and monitoring for anomalous data extraction behaviors. The rapid succession of exploited SharePoint flaws suggests a coordinated or highly opportunistic campaign targeting widely used infrastructure.

Technical Details

  • Vulnerability Type: Critical Remote Code Execution (RCE) via insecure deserialization of untrusted data.
  • Authentication Requirement: Attackers need at least "Site Owner" privileges to inject and execute arbitrary code.
  • Exploitation Method: Threat actors are extracting SharePoint machine keys via single HTTP requests to establish long-term persistence.
  • Timeline: Microsoft patched the issue on July 14; Defused observed initial exploitation attempts on July 17, and WatchTowr confirmed active exploitation shortly after Proof-of-Concept code was released.
  • Context: Part of a cluster of four exploited SharePoint vulnerabilities in one month, including CVE-2026-58644, CVE-2026-56164, and CVE-2026-45659.

Industry Insight

  • Defense in Depth: Relying solely on timely patching is insufficient; organizations must implement strict monitoring for machine key exfiltration and enforce immediate credential rotation upon suspected compromise.
  • Supply Chain & Platform Risk: The high frequency of exploited SharePoint vulnerabilities indicates that major enterprise platforms are prime targets; vendors should prioritize secure coding practices around serialization to reduce the attack surface.
  • Proactive Threat Hunting: Given the delay in official advisories confirming in-the-wild exploitation, security teams should proactively hunt for indicators of compromise related to known vulnerability patterns rather than waiting for official confirmation.

TL;DR

  • Microsoft修复了SharePoint关键远程代码执行漏洞CVE-2026-50522,该漏洞源于不受信任数据的反序列化。
  • 威胁情报机构Defused和WatchTowr确认该漏洞已在野外被利用,攻击者旨在窃取机器密钥以维持长期访问权限。
  • 这是过去一个月内发现的第四个在野利用的SharePoint漏洞,凸显了该平台近期面临的高频安全威胁。
  • 仅打补丁不足以应对风险,防御者必须轮换任何可能暴露资产的凭据,因为攻击者可通过单次请求提取密钥。

为什么值得看

对于依赖Microsoft 365和SharePoint的企业而言,该文章揭示了针对同一平台连续发生的严重安全事件,表明攻击者正集中火力利用反序列化缺陷。它强调了在修补软件漏洞的同时,进行主动的凭据轮换和监控的重要性,为IT安全团队提供了紧迫的行动指南。

技术解析

  • 漏洞机制:CVE-2026-50522是一个关键级别的远程代码执行(RCE)漏洞,根本原因是SharePoint服务器对不受信任数据进行了不安全的反序列化操作。
  • 攻击向量:攻击者需要至少拥有“站点所有者”(Site Owner)级别的认证权限,即可注入任意代码并在SharePoint服务器上远程执行。
  • 利用后果:攻击者不仅执行代码,还通过单一请求提取SharePoint机器密钥(Machine Keys),从而获得长期持久化访问能力,绕过常规的身份验证保护。
  • 生态背景:近期还有CVE-2026-58644、CVE-2026-56164和CVE-2026-45659等其他SharePoint漏洞被证实正在被利用,CISA已知利用漏洞目录中已包含13个SharePoint缺陷。

行业启示

  • 强化身份与凭据管理:鉴于攻击者能轻易窃取机器密钥,企业应实施严格的密钥轮换策略,并考虑使用更高级别的身份验证机制,而不仅仅依赖传统的站点角色权限。
  • 重视反序列化安全:开发和维护团队需严格审查所有涉及数据反序列化的代码路径,确保输入验证和沙箱隔离,防止恶意对象构造。
  • 主动威胁狩猎:由于微软更新漏洞公告存在滞后,安全运营中心(SOC)应结合第三方威胁情报(如Defused和WatchTowr的报告),主动监测异常的文件访问和密钥提取行为,而非被动等待官方补丁通知。

Disclaimer: The above content is generated by AI and is for reference only. 免责声明:以上内容由 AI 生成,仅供参考。

Security 安全