watchTowr sees SharePoint attackers stealing keys that can outlast patches

Why it matters

CVE-2026-50522 shows how stolen authentication material can preserve access after patching, while watchTowr's telemetry demonstrates how quickly public exploit research reaches real attacks.

Benjamin Harris's watchTowr says attackers began exploiting a critical Microsoft SharePoint vulnerability within hours of public proof-of-concept code appearing, using the access to steal cryptographic keys that may remain useful after administrators patch the affected server.

The attacks target on-premises SharePoint deployments vulnerable to CVE-2026-50522, according to a July 21 report from BleepingComputer. Microsoft released fixes on July 14. Once attackers extract a server's machine keys, however, closing the original code-execution route may leave them able to forge authentication tokens, impersonate users and reach SharePoint sites or documents under the forged identity.

The timing fits the premise Harris used to build watchTowr. The security researcher was expelled from school as a teenager after hacking his school network, then moved into professional offensive security. Years of testing one client at a time convinced him that annual penetration tests could not keep pace with attackers, leading him to found watchTowr in Singapore in 2021 as a continuous, automated alternative.

When watchTowr announced a $19 million Series A in October 2024, Harris wrote that "time to exploitation in the wild is now measured in single-digit hours." The round was led by Peak XV, with repeat participation from Prosus Ventures and Cercano Management, bringing watchTowr's reported funding to $29 million. The current SharePoint activity supplies a concrete example of the speed Harris has been selling security teams and investors against.

A patch with an incident-response tail

Microsoft's advisory describes CVE-2026-50522 as deserialization of untrusted data that permits an unauthorized remote attacker to execute code over a network. NVD records a 9.8 critical score and lists SharePoint Enterprise Server 2016, SharePoint Server 2019 and SharePoint Server Subscription Edition among the affected products.

The technical record contains a wrinkle. The Zero Day Initiative advisory describes the bug as an improper verification of a cryptographic signature issue in Microsoft SharePoint. ZDI says the issue was reported to Microsoft on May 21, nearly eight weeks before the July fix.

A public PowerShell demonstration attributed to the researcher Janggggg takes a forged WS-Federation sign-in response to SharePoint's /_trust/default.aspx endpoint and places a malicious .NET BinaryFormatter payload inside a SecurityContextToken cookie. If a vulnerable processing path accepts the token, the payload can execute arbitrary code on the server. BleepingComputer said it did not test the code, though its structure appeared technically legitimate.

Microsoft had not marked CVE-2026-50522 as exploited when the July 14 update shipped, according to BleepingComputer, although Microsoft assessed exploitation as more likely. Six days later, watchTowr said in a LinkedIn alert that its Attacker Eye honeypot network captured successful exploitation attempts within hours of watchTowr identifying public exploit code.

For exposed servers, that sequence changes the job from ordinary patch management to breach assessment. Administrators need the Microsoft update, but systems that were reachable before remediation may also require investigation and replacement of exposed key material and credentials. A clean patch state does not invalidate secrets already copied by an attacker.

Defenders saw the activity before they had a CVE

Defused adds an earlier point to the timeline. The threat-intelligence provider reported an undocumented SharePoint deserialization vector in attacks on July 17, three days before watchTowr's public-exploit observation. Defused could not initially tie the traffic to a named vulnerability. On July 21, Defused assessed the activity as likely involving CVE-2026-50522.

That gap matters to founders building attack-surface, deception and exploit-validation products. A vendor advisory supplies a label and a patch. Internet telemetry can expose attacker behavior before defenders have a clean label, confirmed exploit chain or government remediation deadline. The product challenge is turning that incomplete signal into action without flooding security teams with false alarms.

The available evidence leaves several boundaries around the incident. No attacker has been publicly identified. There is no disclosed victim count, geographic breakdown or industry concentration. It also remains unclear whether the exploitation watchTowr observed used the same public code attributed to Janggggg, even though both appeared on July 20.

SharePoint attackers are returning to machine keys

The persistence method is familiar. In July 2025, attackers exploiting a separate set of on-premises SharePoint vulnerabilities also stole machine keys. Microsoft's account of those attacks described malicious scripts that retrieved key material from compromised servers, allowing continued post-exploitation activity.

CVE-2026-50522 is a different vulnerability, and the current attackers remain unattributed. The repeated interest in machine keys shows why internet-facing collaboration servers carry value beyond the documents stored on them. Their authentication material can become an access mechanism of its own.

Harris built watchTowr around that mismatch in operating tempo: attackers can move from published research to automated exploitation while many organizations still schedule testing and patch deployment as separate, slower processes. The SharePoint activity compresses the full cycle into days, with Defused seeing suspicious traffic on July 17 and watchTowr reporting exploitation tied to public code on July 20. For affected operators, the defensible response has to account for what attackers may already have taken, rather than ending when the update finishes installing.