Installing Microsoft's July security update for a critical SharePoint flaw does not, on its own, get the attacker off the server. That is the warning Colombia's national cyber emergency response team, colCERT, issued on 4 August, in a TLP:CLEAR alert it rated critical with active exploitation confirmed.
The flaw, CVE-2026-50522, lets an attacker with no credentials run code on an internet-facing SharePoint server by sending it a crafted request carrying serialized data that the server unpacks without validating what is inside, a bug class tracked as CWE-502. The code runs with the privileges of the SharePoint service account. In its alert, colCERT says the campaigns it is tracking do not stop there. Their main objective is the cryptographic keys SharePoint uses to sign session tokens. An attacker who walks away with those keys can forge valid session tokens at will, and the security update does nothing to invalidate them.
What's affected
colCERT lists SharePoint Server Subscription Edition, SharePoint Server 2019 and SharePoint Server 2016 Enterprise, on any build earlier than the update Microsoft published on 14 July 2026. Only on-premises installations are in scope. The alert puts the flaw at 9.8 out of 10 on CVSS 3.1, classes it under the SSVC decision model as Act, meaning immediate action rather than scheduled remediation, and notes that it sits in CISA's Known Exploited Vulnerabilities catalog.
IntelFusions reported on 3 August that this was one of four SharePoint vulnerabilities CISA added to that catalog during July, and that it carried by far the highest EPSS exploitation-likelihood score of the four, at roughly 76 percent. What colCERT adds is the part defenders have to act on: what the intruders do once they are inside.
Why patching alone falls short
Session tokens are what a web application hands your browser after you log in, so you are not asked for a password on every click. SharePoint signs them with server-side keys to prove they are genuine. Steal those keys and you can manufacture a token for any account, and the server will accept it, because from its point of view the signature checks out. Patching closes the door the attacker came through. It does not revoke the keys they took on the way in.
That turns this into a compromise-assessment problem rather than a patching problem. colCERT's practical point is that an organization which applied the July update and closed the ticket may still be hosting an intruder holding durable, legitimate-looking access.
What you should do
- Apply the 14 July 2026 update to every on-premises SharePoint farm, and treat it as the first of three steps rather than the fix.
- Rotate the server's cryptographic keys afterwards, on the assumption that an exposed, unpatched server had them taken.
- Hunt for signs of unauthorized access: unexpected sessions, new or modified service accounts, and authenticated activity with no matching login.
The alert carries no indicators of compromise, and Microsoft's advisory for the CVE holds the exact build numbers for each version. colCERT aimed its warning at Colombian public bodies and private firms, noting that SharePoint underpins intranets, document management and citizen service portals across the country, and our Colombia profile tracks its wider exposure. The reasoning applies to any on-premises farm anywhere that was reachable from the internet before mid-July.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.