SharePoint vulnerability steals machine keys; fourth recent exploit

Yet another SharePoint Server vulnerability was exploited in the wild, considered the fourth such Microsoft flaw attacked this month.

News of the new SharePoint flaw came after research groups WatchTowr and Defused observed active exploitation of the 9.8-rated CVE-2026-50522. It also came about one week after the Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies to patch three other SharePoint Server bugs.

What made this one of great concern to security pros was that WatchTowr reported not long after researcher Janggggg released proof-of-concept code that threat actors were stealing machine keys to maintain long-term access.

“Attackers are pulling SharePoint machine keys via a single request,” said the WatchTowr researchers in a post on X. “Patching is not enough, defenders should rotate credentials on any assets that may have been exposed.”

John Strand, owner at Black Hills Information Security, explained that when an attacker steals a machine key, they are no longer impersonating a user: they’re impersonating the machine itself.

“That’s a much more dangerous position for an attacker to be in,” said Strand. “Most incident response playbooks focus on resetting user passwords and disabling accounts. Rotating machine keys is much more complicated, and in many organizations it isn’t part of the standard response process at all. That gives attackers a much more durable form of persistence that can survive actions that would normally remove them from the environment.”

When asked if this most recent flaw is more serious than the first three, Strand said: “I think it is, but I also think we spend too much time trying to rank vulnerabilities against each other. The most important vulnerability is always the one that’s being used to compromise your organization.”

Roy Katmor, co-founder and CEO of Orchid Security, added that stealing SharePoint machine keys is not just credential theft: it’s trust-layer theft. Katmor said attackers may be able to forge trusted authentication material, impersonate users, and preserve access even after the original vulnerability gets patched.

“In identity terms, a software bug becomes an identity persistence problem,” said Katmor. “This bug is potentially more serious because the impact can outlive the patch. If machine keys were exposed, remediation cannot stop at updating SharePoint. Organizations also need key and credential rotation, identity validation, and evidence-based post-exploitation review to understand what trust material, identities, and access paths were exposed."

Justin Beals, founder and CEO at Strike Graph, added that we have to give credit where credit is due: Microsoft patched this fast and researchers caught exploitation within days of Patch Tuesday; that's the system working the way it's supposed to.

“But stealing a machine key isn't the same as stealing a password,” said Beals. “A password reset locks an attacker out. A machine key compromise means the attacker can forge authentication tokens and walk back in after you've patched, after you've rotated credentials on everything else, after you think you're done. Patching the vulnerability closes the door. It doesn't evict the person already inside wearing your uniform.”

Beals added that's what makes this one worse than the first three: not the CVE score, the persistence model.

“Four SharePoint bugs exploited in a month tells us attackers have found a soft, repeatable seam in how enterprises deploy this platform, and they're going to keep pulling on it until organizations change their posture, not just their patch cadence,” said Beals. “Rotate the keys. Assume compromise. Don't just close the ticket."