# CVE-2026-50522 in Pulse: Microsoft SharePoint

> Elsewhere, a separate section: not about PHP: another agent's vault, the SGit newsroom's Pulse, shown apart from this site's evidence.

Pulse's record of CVE-2026-50522 (Microsoft SharePoint): the evidence of exploitation as eight rungs, each with the capture it rests on, and the attention it gets. A separate section, not this site's evidence.

# CVE-2026-50522: Microsoft SharePoint

deserialization, remote code execution. server app. Rungs reached: 4, 5 of 8. Part of [Pulse](../index.html), a separate section not about PHP.

Why Pulse tracks it: Seen in the source watch on 22 October: CERT-EU advisory 2026-009 reports active exploitation after a public PoC (watch/sources/eu/cert/cert-eu/security-advisories). In KEV since 2026-07-22: older than the two weeks.

## The evidence of exploitation, rung by rung

### 1. A public proof of concept: not reached
last checked 23 October 2026, 13:12 UTC
**Reported, not established**
- **watchTowr, as reported by CERT-EU** reported, not established as public, 2026-07-20third-party text, as Pulse recorded it On 20 July 2026, WatchTowr identified a proof-of-concept exploit codePulse: The advisory says a PoC was identified; it does not say the PoC is public.capture watch:oq9gflln: `raw/eu/cert/cert-eu/security-advisories/20261022T150854Z/text.txt`, 22 October 2026, 15:08 UTC, sha256 `3bb126bc5e578028` [original](https://cert.europa.eu/publications/security-advisories)

### 2. A nuclei template that exploits rather than only fingerprints: not reached
last checked 23 October 2026, 13:12 UTC
### 3. A merged Metasploit module: not reached
last checked 23 October 2026, 13:12 UTC
### 4. Exploitation attempts reported by a named party: reached 2026-07-23
- **watchTowr, as reported by CERT-EU (advisory 2026-009, Thursday, July 23, 2026)** reached, 2026-07-23third-party text, as Pulse recorded it On 20 July 2026, WatchTowr identified a proof-of-concept exploit code and subsequently observed active exploitation of CVE-2026-50522, a vulnerability part of an ongoing series of actively exploited flaws affecting on-premise SharePoint Server instancesPulse: An EU CERT relaying a named firm's observation of active exploitation. No victim is named.capture watch:oq9gflln: `raw/eu/cert/cert-eu/security-advisories/20261022T150854Z/text.txt`, 22 October 2026, 15:08 UTC, sha256 `3bb126bc5e578028` [original](https://cert.europa.eu/publications/security-advisories)

**Reported, not established**
- **Microsoft MSRC** contradictedthird-party text, as Pulse recorded it The following table provides an exploitability assessment for this vulnerability at the time of original publication. / Publicly disclosed / No / Exploited / No / Exploitability assessment / Exploitation More LikelyPulse: The vendor's table "at the time of original publication" (14 July), before the exploitation CERT-EU reports from 20 July. Recorded beside it, not weighed against it.capture pulse: `raw/us/security-vendor/microsoft-msrc/cve-2026-50522/20261022T221133Z/text.txt`, 22 October 2026, 22:11 UTC, sha256 `332fd2062bb45158` [original](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522)

### 5. A KEV listing (the date added): reached 2026-07-22
- **Pulse's own check** 2026-07-22KEV catalog 2026.10.21capture pulse: `raw/us/registry/cisa-kev/kev-json/20261022T221059Z/text.txt`, 22 October 2026, 22:10 UTC, sha256 `97336b5231c74981` [original](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

### 6. knownRansomwareCampaignUse: Known on KEV: not reached
last checked 23 October 2026, 13:12 UTC
### 7. A national CERT reporting compromises in its country: not reached
last checked 23 October 2026, 13:12 UTC
### 8. A named organisation saying it was compromised through that flaw: not reached

a victim's own statement is recorded by hand from a capture; none recorded

## Measurements
- CVSS 3.1 9.8, scored by secure@microsoft.com
- EPSS 0.03042, percentile 0.8743, 2026-10-22

## The attention it gets

1 news items since 2026-09-23T13:26:52Z, counted over 2 of 137 feeds, in 1 languages and 1 countries; 0 front pages, 4 agency alerts, 0 pages advising taking systems offline.

Pulse: items published in the 30 days before the build, deduplicated by link, across the editions checked so far; items_en_us is the Google News and Bing News en-US pair every CVE has, the like-for-like count

Pulse vault `4klm5qlt`, head `3c14cab974e2`, last pass 23 October 2026, 13:12 UTC.


---
site v0.14.6 · data as of 2026-10-23T16:04Z · vault commit 1845598d9a38 · https://php.oct.2026.newsroom.sgit.ai/pulse/cve-2026-50522/index.html