Summary
- CERT-FR says two critical Microsoft SharePoint vulnerabilities can allow unauthenticated remote code execution.
- Microsoft has indicated active exploitation of CVE-2026-58644, while CERT-FR cites public proof-of-concept and active exploitation claims for CVE-2026-50522.
- The French agency urges patching and ASP.NET machine key rotation where compromise is suspected.
CERT-FR has warned French organisations that critical Microsoft SharePoint vulnerabilities can allow unauthenticated remote code execution, with exploitation activity already reported and post-patch secret theft remaining a concern.
The 22 July alert covers CVE-2026-50522 and CVE-2026-58644, both addressed by Microsoft in its 14 July security update. CERT-FR says Microsoft has indicated active exploitation of CVE-2026-58644, while security company watchTowr has said it is aware of public proof-of-concept material and active exploitation involving CVE-2026-50522.
Affected products include older builds of SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. CERT-FR recommends applying fixes as quickly as possible. Where compromise is suspected, it also recommends changing secrets, including rotating ASP.NET machine keys for SharePoint Server, because stolen secrets may allow an attacker to return after updates have been installed.
That detail turns the advisory into more than a patching notice. Collaboration platforms often hold document stores, workflow data, authentication material, configuration secrets, and integrations with other systems. If an attacker extracts keys before a patch is applied, remediation has to include containment, investigation, and credential work, not only software updates.
SharePoint remains sensitive because many organisations still operate on-premises deployments in hybrid estates, legacy environments, and high-control settings. Public bodies, regulated sectors, manufacturers, professional services firms, and large enterprises may all retain internal SharePoint servers because business processes and document libraries have accumulated around them over many years.
The risk is not limited to direct document access. SharePoint can sit close to identity systems, intranet applications, departmental workflows, and privileged administrative accounts. A compromised server can give an attacker useful internal context, stored files, authentication material, and a platform for further movement if network segmentation and monitoring are weak.
European regulatory expectations also raise the bar for response. Under NIS2-aligned regimes and sector-specific resilience rules, organisations need to show they can identify affected systems, apply patches within a risk-based window, investigate possible exploitation, rotate relevant secrets, and record decisions. A high-profile exploited flaw in a core collaboration system is difficult to treat as routine maintenance.
Managed service providers and outsourced administrators carry additional exposure. Providers that maintain SharePoint estates for several customers may be working through similar deployment patterns, shared operational processes, and privileged access arrangements. A fragmented response could turn a product flaw into a wider third-party incident.
The practical work now sits in asset inventories, exposure checks, patch confirmation, log review, key rotation, and downstream trust validation. A SharePoint server may appear recovered once the update is applied, but a copied machine key or unreviewed privileged account can preserve the attacker’s route back into the environment.
