CVE-2026-50522

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jul 23, 2026

Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Jul 14, 2026
Last modified
Jul 23, 2026
Added to CISA KEV
Jul 22, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-505237.8Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an authorized attacker toCVE-2026-505247.5Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.CVE-2026-505257.5Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-505265.5Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.CVE-2026-505277.5Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.CVE-2026-505288.2Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-505298.7DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share interface generates andCVE-2026-50537.1NoMachine External Control of File Path Arbitrary File Deletion Vulnerability. This vulnerability allows local attackers to delete arbitraryCVE-2026-505307.1DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface only validates that sceCVE-2026-505388.8LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNCCVE-2026-50547.8NoMachine External Control of File Path Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privCVE-2026-505409.6Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like cont
CVE-2026-50522: Critical severity, CVSS 9.8 | Vulnix