Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation Afte…

CVE-2026-50522, a critical remote code execution flaw in Microsoft SharePoint Server, is under active exploitation following public PoC release. Attackers authenticated as Site Owner can execute arbitrary code and steal machine keys for persistent access. If you're selling to enterprises running SharePoint on-premises, their machine keys are being stolen right now—patch alone won't stop active attackers. You have a three-week window to help them rotate credentials before persistence becomes undetectable.