The Next SharePoint 9.8 Arrived in Eight Days
Three days ago we wrote that SharePoint Server 2016 and 2019 had just taken their last security update ever, and that the only real question was how long before another critical, exploited-in-the-wild flaw showed up with no fix behind it. The honest framing at the time was that you should not plan around if.
It took eight days.
On July 22, 2026, CISA added CVE-2026-50522 to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies until July 25 to remediate. It is a deserialization of untrusted data flaw in SharePoint Server rated CVSS 9.8, yielding remote code execution. A public proof-of-concept exploit appeared on July 20; active exploitation followed within hours. (The Hacker News; Security Affairs; SecurityWeek.)
What CVE-2026-50522 actually is
CVE-2026-50522 is the same shape of bug that has made SharePoint on-premises a magnet all year: untrusted data gets deserialized, and an attacker turns that into code execution on the server. Microsoft's advisory documents it as requiring at least Site Owner privileges — but security researchers analyzing captured exploitation traffic reported requests carrying no authentication material, matching an unauthenticated profile in practice. Either way, the outcome on an unpatched, reachable server is the same: remote code execution on a system that sits on your documents and inside your Windows identity fabric.
| Detail | CVE-2026-50522 |
|---|---|
| Type | Deserialization of untrusted data (CWE-502) → remote code execution |
| Severity | CVSS 9.8 (critical) |
| Affected | SharePoint Server 2016, 2019, and Subscription Edition |
| Fixed | July 14, 2026 updates (all three versions) |
| Public PoC | July 20, 2026 |
| Added to CISA KEV | July 22, 2026 |
| Federal remediation deadline | July 25, 2026 |
Why "it was patched" is not the reassurance it sounds like
Two things are true at once, and holding both is the whole point of tracking end-of-life dates properly.
If you applied the July 14 updates, you are protected against this specific flaw on 2016 and 2019. Good. That was the last update those versions will ever get, and it happened to earn its keep twice over — 58644 and 50522 in one drop.
If you did not, you now have a public exploit and active in-the-wild attacks pointed at a version that can never be patched again. The July 14 update is still available and you should apply it today — but there is no next one. For a supported product, "we're a bit behind on patching" is a scheduling problem. For SharePoint 2016 and 2019 after July 14, it is the difference between the last fix and no fix.
This is a base rate, not a bad week
Line the recent SharePoint flaws up and the pattern is the story. CISA has flagged a run of actively exploited SharePoint vulnerabilities in a matter of months — CVE-2026-56164, CVE-2026-58644 and now CVE-2026-50522 among them — and issued a dedicated SharePoint hardening alert on July 14. Reports differ on exactly how to count them, which is itself the point: there are enough that the ordering is a footnote.
That cadence does not slow down because a support date passed. What changed on July 14 is not the attackers' interest or the rate of disclosure — it is that, from the next flaw onward, the response option for 2016 and 2019 is gone. CVE-2026-50522 is the last one where the answer was "apply the update." The one after it, whenever it lands, has no update to apply.
The three destinations
There are only three real answers for SharePoint Server 2016 and 2019, and the right one depends mostly on how much custom development you cannot walk away from.
| Path | Best when | The catch |
|---|---|---|
| SharePoint Server Subscription Edition | You need on-premises and have farm solutions or data-residency constraints that rule out cloud | Licensing moves to a subscription; you commit to staying continuously current instead of upgrading every few years |
| SharePoint Online (Microsoft 365) | Your usage is mostly document libraries, sites and collaboration | Full-trust farm solutions don't migrate; heavily customized sites need rebuilding, which is where timelines slip |
| Another platform | SharePoint was never a great fit and this is the forcing function | Longest path; realistic only if you were already drifting off SharePoint |
A full migration is typically a 6-to-18-month project. The exposure is here now. So decouple the two: removing an on-premises 2016 or 2019 farm from the public internet is an afternoon's work, and it converts an unpatchable internet-facing target into an unpatchable internal one while the real migration runs. If you need help scoping post-EOL security cover or a migration, our extended-support and migration options page lays out the independent choices — we track the dates; vendors don't pay for placement.
The lesson, restated
An end-of-support date changes nothing about your software and everything about your options. CVE-2026-50522 is the cleanest possible demonstration: identical bug class, identical attacker behavior, identical CVSS to the flaws before it — and the only variable that moved is whether a fix exists on the other side. On July 13 it would have. Going forward it won't.
The practical habit is to plan around the last patch date, not the last release date, and to check whether a product even has an ESU-style escape hatch before assuming a deadline is soft. SharePoint doesn't. Check any version in seconds, scan your whole stack, or read our full SharePoint 2016/2019 end-of-life guide — all against dates verified against vendor sources.
Frequently Asked Questions
What is CVE-2026-50522?
A critical deserialization of untrusted data flaw (CWE-502) in SharePoint Server, rated CVSS 9.8, allowing remote code execution. It affects SharePoint Server 2016, 2019, and Subscription Edition and was fixed in the July 14, 2026 updates. A public PoC appeared July 20, active exploitation followed, and CISA added it to the KEV catalog on July 22 with a July 25 federal remediation deadline.
Were SharePoint 2016 and 2019 patched for it?
Yes — in the July 14, 2026 updates, the last security update those versions will ever receive, released the same day their extended support ended. A fully updated 2016 or 2019 farm is protected against CVE-2026-50522. The catch is that any comparable flaw disclosed after July 14 will be fixed only in Subscription Edition.
Is there an ESU program for SharePoint Server 2016 or 2019?
No. Unlike Windows 10 and Windows Server, SharePoint Server has no Extended Security Updates program. July 14, 2026 was a hard cutoff — no security updates at any price, from Microsoft or anyone else, because no third party can patch proprietary SharePoint code. Subscription Edition remains supported under the Modern Lifecycle Policy.
Is the authentication requirement real — does an attacker need an account?
Microsoft documents CVE-2026-50522 as requiring at least Site Owner privileges. However, researchers analyzing observed exploitation reported traffic carrying no authentication material, consistent with an unauthenticated attack in practice. Treat any internet-facing, unpatched 2016 or 2019 farm as exposed regardless of the nominal privilege requirement.
I'm still on 2016 or 2019 — what do I do this week?
Apply the July 14 updates on every farm if you haven't; they contain the fix and a public exploit is circulating. Check for prior compromise, since attackers have stolen IIS machine keys for persistence that patching doesn't remove. Take internet-facing farms off the public internet. Then pick a destination: Subscription Edition, SharePoint Online, or another platform. This was the last flaw those versions will be patched against.