CVE-2026-50522: Microsoft SharePoint

1. A public proof of concept: not reached

Reported, not established

• watchTowr, as reported by CERT-EU reported, not established as public, 2026-07-20

  third-party text, as Pulse recorded it
  On 20 July 2026, WatchTowr identified a proof-of-concept exploit code

  Pulse: The advisory says a PoC was identified; it does not say the PoC is public.
  capture watch:oq9gflln: raw/eu/cert/cert-eu/security-advisories/20261022T150854Z/text.txt, 22 October 2026, 15:08 UTC, sha256 3bb126bc5e578028 original

2. A nuclei template that exploits rather than only fingerprints: not reached

3. A merged Metasploit module: not reached

4. Exploitation attempts reported by a named party: reached 2026-07-23

• watchTowr, as reported by CERT-EU (advisory 2026-009, Thursday, July 23, 2026) reached, 2026-07-23

  third-party text, as Pulse recorded it
  On 20 July 2026, WatchTowr identified a proof-of-concept exploit code and subsequently observed active exploitation of CVE-2026-50522, a vulnerability part of an ongoing series of actively exploited flaws affecting on-premise SharePoint Server instances

  Pulse: An EU CERT relaying a named firm's observation of active exploitation. No victim is named.
  capture watch:oq9gflln: raw/eu/cert/cert-eu/security-advisories/20261022T150854Z/text.txt, 22 October 2026, 15:08 UTC, sha256 3bb126bc5e578028 original

Reported, not established

• Microsoft MSRC contradicted

  third-party text, as Pulse recorded it
  The following table provides an exploitability assessment for this vulnerability at the time of original publication. / Publicly disclosed / No / Exploited / No / Exploitability assessment / Exploitation More Likely

  Pulse: The vendor's table "at the time of original publication" (14 July), before the exploitation CERT-EU reports from 20 July. Recorded beside it, not weighed against it.
  capture pulse: raw/us/security-vendor/microsoft-msrc/cve-2026-50522/20261022T221133Z/text.txt, 22 October 2026, 22:11 UTC, sha256 332fd2062bb45158 original

5. A KEV listing (the date added): reached 2026-07-22

• Pulse's own check 2026-07-22
  KEV catalog 2026.10.21
  capture pulse: raw/us/registry/cisa-kev/kev-json/20261022T221059Z/text.txt, 22 October 2026, 22:10 UTC, sha256 97336b5231c74981 original

6. knownRansomwareCampaignUse: Known on KEV: not reached

7. A national CERT reporting compromises in its country: not reached

8. A named organisation saying it was compromised through that flaw: not reached

a victim's own statement is recorded by hand from a capture; none recorded