Sharepoint — PoC Archivehttps://poc.intelseclab.com/tags/sharepoint/Latest proof-of-concept entries.Hugoen-usMon, 27 Jul 2026 00:00:00 +0000Microsoft SharePoint Server WS-Federation SecurityContextToken Deserialization → Unauthenticated RCE (CVE-2026-50522)https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-50522-sharepoint-preauth-rce/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-50522-sharepoint-preauth-rce/Critical severity (CVSS 9.8) — web · CVE-2026-50522. Status: Weaponized — public PoC confirmed used in real attacks within hours of release (watchTowr honeypot telemetry). Affects: Microsoft SharePoint Server (on-premises). Tags: sharepoint, deserialization, binaryformatter, ws-federation, unauthenticated, rce, kev, actively-exploited, microsoft.webCriticalsharepointdeserializationbinaryformatterws-federationunauthenticatedrcekevactively-exploitedmicrosoftToolShell - SharePoint Unauthenticated RCE Chainhttps://poc.intelseclab.com/pocs/web/2026-05-17_toolshell-sharepoint-chain/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_toolshell-sharepoint-chain/Critical severity — web · CVE-2025-53770, CVE-2025-53771, CVE-2025-49704, CVE-2025-49706. Status: Weaponized. Affects: Microsoft SharePoint Server. Tags: RCE, SharePoint, unauthenticated, deserialization, auth-bypass, APT27, APT31, ransomware, Windows, IIS.webCriticalRCESharePointunauthenticateddeserializationauth-bypassAPT27APT31ransomwareWindowsIIS