Vulnerability record · CVE-2026-58644 · published 14 July 2026
CVE-2026-58644: Microsoft SharePoint deserialization flaw allows remote code execution
Microsoft · Sharepoint Server
Microsoft SharePoint Server deserializes untrusted data, letting an unauthenticated network attacker execute code. The flaw is rated CVSS 9.8 critical and was added to CISA's KEV catalog, so it warrants urgent attention.
Description
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 unauthenticated remote code execution combined with KEV listing and a near-term federal remediation deadline makes this an urgent patch.
What it is
Microsoft SharePoint Server deserializes untrusted data, letting an unauthenticated network attacker execute code. The flaw is rated CVSS 9.8 critical and was added to CISA's KEV catalog, so it warrants urgent attention.
Impact
An attacker can run arbitrary code on the SharePoint server, gaining full control of confidentiality, integrity and availability of the host and its data.
Attack surface
Reachable over the network via the SharePoint service with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N.
Exploitation
CISA added it to KEV on 2026-07-16 with a 2026-07-19 remediation due date, indicating active exploitation; EPSS 30-day probability is 0.159 (96.7th percentile). No ransomware campaign use is documented.
What to do
- Apply the Microsoft patch from the MSRC update guide immediately; this is the primary fix.
- If patching is not possible, follow CISA BOD 26-04 guidance, including discontinuing use of the product or isolating it from the internet.
- Restrict network access to SharePoint endpoints and place them behind authentication-aware reverse proxies where feasible.
- Monitor vendor advisories for updated mitigation instructions and re-check exposure of internet-facing instances.
Detection
- Hunt for unexpected w3wp.exe or SharePoint worker process spawning of cmd.exe, powershell.exe or other child processes.
- Review SharePoint and IIS logs for anomalous POST requests or serialized payload patterns to SharePoint endpoints.
- Alert on outbound network connections from SharePoint servers to unfamiliar external hosts.
- Correlate process creation and file-write telemetry on SharePoint hosts for signs of web shell or payload drops.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2026-58644 to the Known Exploited Vulnerabilities catalog on 16 July 2026 as "Microsoft SharePoint Deserialization of Untrusted Data Vulnerability". Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal deadline 19 July 2026.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644 | PatchVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644 | US Government Resource |
Track CVE-2026-58644 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2026-58644), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
