On 14 July 2026, Microsoft released emergency patches for two critical vulnerabilities in SharePoint Server: CVE-2026-58644 and CVE-2026-50522, both scoring CVSS 9.8. CVE-2026-58644 had already been exploited in the wild before the patch landed — a confirmed zero-day at the time of disclosure. CVE-2026-50522 was weaponised within hours of a public proof-of-concept. Two days later, on 16 July, CISA added both to its Known Exploited Vulnerabilities catalog and mandated federal remediation within three days. Threat actors are not merely executing code on SharePoint; they are using these vulnerabilities to steal IIS machine keys — a form of persistence that survives patching. For Swiss organisations running SharePoint on-premises in hybrid Active Directory Federation Services environments, the blast radius extends directly into Microsoft 365.

The Dual-CVE Chain and the Machine Key Attack

Both vulnerabilities stem from the same root cause: deserialisation of untrusted data. SharePoint’s page-rendering and workflow subsystems deserialise user-controlled input without sufficient validation. CVE-2026-58644 affects the primary rendering pipeline and requires no authentication whatsoever — an unauthenticated attacker sends a crafted HTTP request to a publicly accessible endpoint and achieves remote code execution with the privileges of the IIS application pool, typically a highly privileged service account. CVE-2026-50522 targets a secondary subsystem; it was not exploited as a zero-day but was rapidly weaponised after Patch Tuesday because the patch itself is reverse-engineerable.

The machine key attack is the detail that elevates this incident beyond a routine patch-and-move-on scenario. When an attacker gains code execution on a SharePoint server, they can read the ASP.NET machine key from the web.config file or the registry — a secret used to sign and encrypt ViewState, authentication tickets, and session identifiers. Armed with a valid machine key, an attacker can forge arbitrary ASP.NET ViewState payloads that the server treats as trusted, signed data. This grants persistent, authentication-free code execution that continues to function even after the RCE vulnerability is patched. Crucially, if the attacker exfiltrated the machine key before the patch was applied, rotating it must happen carefully: the server must first be swept for evidence of compromise, because rotating keys before hunting for attacker artefacts can destroy forensic evidence and create a false sense of remediation.

CrowdStrike’s Patch Tuesday analysis confirmed that machine key theft via CVE-2026-58644 was observed in the wild before public disclosure. The Cloud Security Alliance issued a research note classifying this as a KEV priority-one scenario. Researchers at SecurityArsenal documented the full exploitation chain, including AMSI evasion techniques used by the initial wave of attackers.

Swiss Attack Surface: On-Premises SharePoint in Context

SharePoint Server on-premises (2016, 2019, and Subscription Edition — all three affected) is more prevalent in Swiss enterprise environments than cloud-first markets might suggest. Swiss financial institutions operate under FINMA data-residency and sovereignty expectations that have historically slowed migrations to SharePoint Online; cantonal and federal administrations have similar requirements under the Information Security Act. Swiss pharmaceutical groups, precision manufacturers, and hospital networks maintain on-premises SharePoint as document management and intranet infrastructure, often running versions that trail the latest release cycle by one or two major versions.

Many of these deployments use hybrid AD FS configurations: the on-premises SharePoint server is Kerberos-joined to the same domain as an AD FS proxy that federates identity into Microsoft 365 or Azure Entra ID. In this architecture, compromise of the SharePoint server can yield domain credentials cached in IIS worker process memory, AD FS token signing key material if the AD FS and SharePoint roles share a host or are on the same subnet, and Kerberos service tickets that allow lateral movement into Exchange or Teams on-premises infrastructure. The four-year-old assumption that “we are mostly on-prem, so cloud attacks don’t apply to us” is precisely what makes these hybrid estate configurations dangerous: the on-premises foothold provides a path into the cloud.

Internet-accessible SharePoint instances are not required for exploitation in all scenarios. Attackers operating inside a compromised perimeter — via a phishing campaign, an MSP compromise, or a prior VPN breach — can reach internal SharePoint servers without any internet exposure. The KEV mandate applies to external exposure, but internal patching is equally urgent.

Regulatory Implications for Swiss Organisations

FINMA Circular 2023/1 on Technology and Outsourcing requires supervised financial institutions to report significant ICT incidents to FINMA within 24 hours of detection, with a follow-up report within 72 hours and a final root-cause report within 30 days. The ISA (Informationssicherheitsgesetz) imposes equivalent obligations on critical infrastructure operators, with the 24-hour clock starting at the moment of detection — not the moment of board awareness or legal sign-off. Both regimes apply equally to incidents at third-party providers, but this vulnerability affects infrastructure that Swiss organisations typically operate themselves.

The machine key theft dynamic creates a specific regulatory complexity. If attackers stole a machine key before the patch was applied, the compromise window extends retroactively to the date of initial exploitation — not the date of patch release. Swiss organisations must scope their incident investigation to the full pre-patch exposure period, which CISA’s KEV data suggests began in earnest before 14 July. If evidence of machine key access is found, the 24-hour notification clock starts from the moment that evidence is identified. Security teams that patch without hunting first — and subsequently discover machine key exfiltration weeks later — will face a difficult conversation with regulators about why notification was delayed.

◆ Key Takeaway

Both CVEs are CVSS 9.8 zero-days in active exploitation. Patching is necessary but not sufficient: stolen IIS machine keys enable persistent code execution that survives the patch. Swiss organisations must hunt for evidence of compromise before rotating keys, not after — and must treat any key exfiltration as a notifiable incident under FINMA Circular 2023/1 and ISA.

Immediate Actions for Swiss IT and Security Teams

• Identify all on-premises SharePoint instances. Audit asset management and network diagrams for SharePoint 2016, 2019, and Subscription Edition. Include servers in DMZs, branch offices, and infrastructure operated by third-party integrators on your behalf.
• Apply July 2026 patches without waiting for the next change-control window. Both CVEs are KEV-listed and actively exploited. Emergency change-management procedures should be invoked. If an emergency CAB process does not exist, this is the moment to create one.
• Hunt for indicators of machine key theft before rotating keys. Search IIS logs and SharePoint ULS logs for the exploitation indicators published by CISA and SecurityArsenal (unexpected POST requests to page-rendering endpoints with oversized or malformed ViewState parameters). Escalate anomalies to your SOC before proceeding to remediation.
• Rotate IIS machine keys across all SharePoint web applications after hunting. Rotation without prior hunting destroys forensic evidence. After hunting is complete, rotate the machineKey values in web.config for every SharePoint web application, including Central Administration.
• Enable AMSI integration in Full Mode. SharePoint’s AMSI integration intercepts suspicious request payloads before deserialisation. Enabling it in Full Mode reduces exploit dwell time and improves detection coverage. Validate that Windows Defender or your endpoint security agent is configured to receive AMSI events.
• Audit AD FS if SharePoint and AD FS share infrastructure. Review AD FS token signing and decryption certificates for unexpected access. If the SharePoint server and the AD FS proxy are on the same host or subnet, treat the AD FS key store as potentially compromised and initiate certificate rotation.
• Pre-stage FINMA and NCSC incident notification templates. If compromise indicators are found, the 24-hour notification clock starts immediately. Contact details, the Meldebogen form for NCSC, and the FINMA ICT incident reporting portal should be accessible to your CISO and legal team without a scavenger hunt at midnight.

The combination of CVSS 9.8, confirmed zero-day status, machine key theft persistence, and KEV-listed active exploitation makes this one of the most consequential patch events of H1–H2 2026 for Swiss on-premises Microsoft estates. The patch window has closed; the hunt-and-rotate window is now.