tag
Sharepoint
CVE-2026-50522
web
CRITICAL 9.8
KEV
EPSS 77%
Microsoft SharePoint Server WS-Federation SecurityContextToken Deserialization → Unauthenticated RCE (CVE-2026-50522)
SharePoint's WS-Federation passive sign-in endpoint (/trust/default.aspx) accepts a wresult parameter containing a WS-Trust RequestSecurityTokenResponse that can carry a SecurityContextToken with an embedded Cookie value. Windows Identity Foundation's…
Patched
2026-07-27
CVE-2025-53770, CVE-2025-53771, CVE-2025-49704, CVE-2025-49706
web
CRITICAL
KEV
Ransomware
EPSS 100%
ToolShell - SharePoint Unauthenticated RCE Chain
CVE-2025-53770 ("ToolShell") is a full unauthenticated remote code execution chain against Microsoft SharePoint Server. The chain combines an authentication bypass in the ToolPane.aspx endpoint (CVE-2025-49706 / patch bypass CVE-2025-53771) with an unsafe…
Patched
2026-05-17