CVE-2026-58644

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-58644 9.8

Microsoft · SharePoint · Added 2026-07-16 · Published 2026-07-14

3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityMicrosoft SharePoint Deserialization of Untrusted Data Vulnerability

VendorMicrosoft

ProductSharePoint

Date added2026-07-16

Due date2026-07-19

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-502

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.

NVD: Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-07-17 07:34 UTC

Wall time0.5s

Searches3

Component defaultyes

Sources https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644
https://nvd.nist.gov/vuln/detail/CVE-2026-58644
https://github.com/advisories/ghsa-q6cq-5qpf-q237
https://www.ionix.io/threat-center/cve-2026-58644/
https://www.action1.com/vulnerabilities/cve-2026-58644/
https://www.rapid7.com/blog/post/em-patch-tuesday-july-2026/
https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

warn component_extraction: Component 'SharePoint Server deserialization logic' matches or contains product name 'SharePoint' — no specific component identified

Hunting hypothesis agent

Monitor for unauthenticated HTTP requests to SharePoint endpoints exhibiting signs of deserialization payload patterns (e.g., Base64-encoded serialized objects, .NET binary formatter magic bytes in request bodies).

Research details

ComponentSharePoint Server deserialization logic

PreconditionsNetwork reachability to a vulnerable SharePoint Server endpoint (2016/2019/Subscription Edition) — no authentication required. The deserialization flaw resides in server-side processing and can be triggered by any unauthenticated HTTP request. AMSI integration (enabled by default in recent updates) does not block this vulnerability class. Proof-of-concept exploit code maturity is currently unproven; no public exploit code has been observed as of this research cycle. agent

DeliverySpecially crafted network request to a vulnerable SharePoint endpoint; no authentication or user interaction required. Affected endpoints include the server-side deserialization logic in SharePoint.

Public PoCno

Advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS 9.8) | No public PoC identified in this cycle | Exploitation likely via crafted network requests to SharePoint endpoints; unauthenticated remote code execution is possible. Rapid7 Patch Tuesday (July 2026) notes CVE-2026-55040 as a separate critical SharePoint auth bypass.

SummaryCritical (CVSS 9.8) unauthenticated deserialization RCE in Microsoft SharePoint Server (Enterprise 2016, Server 2019, Subscription Edition). Affects versions prior to 16.0.5556.1005 (2016), 16.0.10417.20153 (2019), 16.0.19725.20384 (SE). No public PoC confirmed as of 2026-07-17, but CISA reports active exploitation. Vendor patch available via Microsoft Security Response Center.

Tia coverage

First reported2026-07-17

First exploit report2026-07-17

Exploit report → KEV1 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-adds-cve-2026-58644-sharepoint-rce-zero-day-and-two-fortine cve-2026-50522-new-sharepoint-rce-actively-exploited-to-steal-ma microsoft-sharepoint-exploitation-fourth-kev-entry-tenable-confi warlock-ransomware-breach-sharepoint-in-water-telecom-operator-a

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.