Hackers steal SharePoint IIS machine keys using CVE‑2026‑50522 RCE
Threat intel firm WatchTowr confirms attackers are exploiting the critical SharePoint RCE (CVE‑2026‑50522) to extract IIS machine keys, letting them retain footholds even after servers are patched. The bug enables unauthenticated code execution on on‑premise SharePoint Server, forcing admins to patch and immediately rotate machine keys.