CVE-2026-58644: Critical SharePoint RCE Vulnerability Actively Exploited

Microsoft SharePoint administrators are facing another high-priority security issue that should not be treated as a routine patching task.

CVE-2026-58644 is a critical deserialization vulnerability in Microsoft Office SharePoint that can allow an unauthorized attacker to execute code remotely over the network. Microsoft assigned the vulnerability a CVSS 3.1 score of 9.8, with the attack requiring no privileges and no user interaction.

More importantly, this is not merely a theoretical vulnerability. CISA added CVE-2026-58644 to its Known Exploited Vulnerabilities (KEV) catalog on July 16, 2026, and NVD records the exploitation status as active and automatable.

For organizations running Internet-accessible, on-premises SharePoint, this vulnerability deserves immediate attention.

What Is CVE-2026-58644?

CVE-2026-58644 is caused by deserialization of untrusted data in Microsoft Office SharePoint.

In simple terms, an application may deserialize data received from an external source and reconstruct objects from that data. If attacker-controlled data reaches a dangerous deserialization path without adequate validation, the attacker may be able to manipulate the process and cause unintended code execution.

Microsoft describes CVE-2026-58644 as a vulnerability that allows an unauthorized attacker to execute code over a network. NVD classifies it under CWE-502: Deserialization of Untrusted Data.

The important part for defenders is the attack profile:

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: High
CVSS: 9.8 Critical

The CVSS vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This combination makes the vulnerability particularly dangerous because a successful attack does not depend on obtaining valid credentials or convincing a victim to click something.

Why CVE-2026-58644 Is Extremely Dangerous

A CVSS score alone does not determine how urgently an organization should respond. In this case, several signals point in the same direction.

1. No authentication is required

The CVSS vector specifies PR:N, meaning privileges are not required.

That removes one of the major barriers normally present in server-side attacks.

2. No user interaction is required

The vulnerability has UI:N in the CVSS vector.

An attacker does not need an employee to open a document, click a malicious link, or approve a prompt for exploitation to potentially succeed.

3. Remote exploitation is possible

The attack vector is network-based.

For organizations exposing SharePoint services to the Internet, that dramatically increases the potential attack surface.

4. Successful exploitation can affect the entire security triad

The vulnerability carries high impacts for:

Confidentiality
Integrity
Availability

In practical terms, successful remote code execution can potentially turn a vulnerable SharePoint server into a foothold for further attacker activity.

5. Exploitation is already confirmed

This is arguably the most important factor.

CISA added CVE-2026-58644 to its KEV catalog on July 16, 2026. The NVD record also shows CISA's SSVC assessment as active exploitation, automatable, and having total technical impact.

CERT-In has separately warned that CVE-2026-58644 is being exploited in the wild and advised users to apply Microsoft's security updates immediately.

Affected SharePoint Versions

Organizations should check their exact SharePoint build rather than relying only on the major product version.

The NVD record identifies affected configurations including SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.

Current fixed-build information reported by the Canadian Centre for Cyber Security is:

Product	Vulnerable	Fixed
SharePoint Enterprise Server 2016	Before 16.0.5561.1001	16.0.5561.1001
SharePoint Server 2019	Before 16.0.10417.20175	16.0.10417.20175
SharePoint Server Subscription Edition	Before 16.0.19725.20434	16.0.19725.20434

Important: Some databases and third-party references still display older affected-version boundaries because CVE records and vendor data have undergone updates. For production patch decisions, administrators should follow Microsoft's advisory and verify the installed build after applying the appropriate security update.

How Attackers Could Abuse the Vulnerability

At a high level, an attack against a vulnerable SharePoint deployment can be thought of as:

Internet/network access → malicious request → unsafe deserialization → code execution → server compromise

The critical weakness is the deserialization stage.

An attacker supplies specially crafted data to a vulnerable SharePoint component. If that data reaches a vulnerable deserialization path, the server may process attacker-controlled objects in an unsafe manner.

The result can be remote code execution in the security context available to the vulnerable SharePoint process.

Because the vulnerability requires no authentication and has low attack complexity, Internet-facing SharePoint systems should be considered high-risk until patched.

CVE-2026-58644 and the July 2026 SharePoint Attack Landscape

CVE-2026-58644 did not appear in isolation.

Microsoft's July 2026 security updates addressed several serious SharePoint vulnerabilities. Security researchers and government security organizations have highlighted multiple SharePoint flaws from the same update cycle, including authentication-related and additional remote-code-execution vulnerabilities.

This matters operationally because organizations should not patch one SharePoint CVE and assume the server is completely protected.

A proper remediation exercise should review all July 2026 SharePoint security updates applicable to the organization's deployment.

Patch Information

Microsoft released security updates for the affected SharePoint versions in July 2026.

Public technical references identify updates including:

SharePoint Server Subscription Edition: KB5002882
SharePoint Server 2019: KB5002883 and KB5002885
SharePoint Server 2016: KB5002891 and KB5002892

These update mappings should be verified against Microsoft's official security guidance and the exact SharePoint language/build configuration before deployment.

After patching, do not simply check whether Windows Update reports success.

Verify the actual SharePoint farm build.

How to Check the SharePoint Build

SharePoint administrators can check the farm build through the SharePoint Management Shell.

A commonly used command is:

(Get-SPFarm).BuildVersion

Compare the returned version with the appropriate fixed build for your SharePoint edition.

For example, a Subscription Edition deployment should be at or above:

16.0.19725.20434

The exact fixed version must correspond to the SharePoint release you operate.

Immediate Mitigation If You Cannot Patch

Patching is the preferred remediation.

If an affected SharePoint server cannot immediately be updated, organizations should reduce its exposure while preparing the permanent fix.

The New Zealand National Cyber Security Centre recommends updating affected SharePoint systems and, where remediation cannot immediately be performed, isolating SharePoint from the Internet.

Defenders should consider:

Removing unnecessary Internet exposure.
Restricting inbound access through network controls.
Limiting access to trusted administrative networks.
Reviewing reverse-proxy and WAF controls.
Increasing monitoring around exposed SharePoint endpoints.
Applying Microsoft's recommended mitigations.
Scheduling the security update as an emergency change rather than waiting for the next normal maintenance cycle.

Mitigation should not be treated as a substitute for patching.

Detection and Incident Response

Because CVE-2026-58644 is actively exploited, patching and compromise assessment should be considered together.

If your organization had an affected SharePoint server exposed to the Internet before patching, investigate for evidence of compromise.

Security teams should look for:

Unexpected SharePoint processes
Suspicious child processes
New or modified web shells
Unusual PowerShell activity
Unexpected executable files
Suspicious outbound connections
Unknown administrative accounts
Unexpected changes to SharePoint configuration
Unauthorized access attempts
Abnormal authentication activity
Unexpected scheduled tasks or persistence mechanisms
Suspicious changes involving SharePoint machine keys or secrets

The Canadian Centre for Cyber Security specifically recommends monitoring SharePoint servers for suspicious requests, web shells, malicious processes, unauthorized access attempts, and indicators associated with machine-key theft.

Do Not Assume That Patching Alone Erases a Compromise

This is an important distinction.

If an attacker gained code execution before the server was patched, installing the update fixes the vulnerability but does not automatically remove attacker persistence.

For potentially compromised systems, incident responders should:

Preserve relevant logs.
Identify the initial exposure window.
Review IIS and SharePoint logs.
Search for suspicious files and web shells.
Review process execution telemetry.
Investigate unusual outbound traffic.
Check administrative and service-account activity.
Review authentication events.
Investigate signs of credential or secret theft.
Rotate affected secrets where compromise is suspected.

CERT-FR has also recommended secret rotation, including ASP.NET SharePoint machine-key rotation, when compromise is suspected.

Why Internet-Facing SharePoint Deserves Priority

SharePoint is often treated as an internal collaboration platform.

That assumption can be dangerous.

Many organizations expose SharePoint directly or indirectly through:

Reverse proxies
VPN gateways
Application delivery controllers
Remote-access infrastructure
Publishing portals
Partner-access environments

An externally reachable SharePoint server therefore becomes a potentially valuable target.

The combination of remote attack + no authentication + low complexity + high impact + active exploitation should move CVE-2026-58644 toward the top of an organization's vulnerability queue.

Recommended SOC Monitoring

SOC teams should create a temporary elevated monitoring profile for vulnerable or recently patched SharePoint servers.

Useful telemetry includes:

Network

Monitor for:

Unexpected inbound requests
Unusual request patterns
Connections from previously unseen external IP addresses
Suspicious outbound connections from SharePoint servers
Unexpected DNS lookups

Endpoint

Monitor:

IIS worker process behavior
Unexpected PowerShell execution
Command shells launched by SharePoint-related processes
New executable files
Web-shell-like files
Persistence mechanisms

Identity

Review:

New privileged accounts
Unexpected service-account activity
Authentication anomalies
Privilege changes
Suspicious administrative actions

File Integrity

Pay particular attention to:

SharePoint web directories
IIS web content
Unexpected .aspx files
Recently modified scripts
Unknown binaries

The goal is not simply to determine whether the server is patched.

The goal is to determine whether an attacker had an opportunity to exploit it before remediation.

CVE-2026-58644 Risk Rating

For most organizations, I would classify this vulnerability as:

Priority: P0 / Emergency

A practical risk model looks like this:

Risk factor	Assessment
Severity	Critical
CVSS	9.8
Authentication	Not required
User interaction	Not required
Attack vector	Network
Complexity	Low
Remote Code Execution	Yes
CISA KEV	Yes
Active exploitation	Yes
Internet-facing risk	Very high
Patch available	Yes

This combination is considerably more important than a CVE that merely has a high numerical CVSS score but has no evidence of exploitation.

Recommended Enterprise Response

Security teams should use the following order of operations:

Step 1 — Identify

Inventory every on-premises SharePoint Server instance.

Step 2 — Determine exposure

Identify which systems are Internet-facing or reachable from untrusted networks.

Step 3 — Check builds

Compare every SharePoint build against the fixed versions.

Step 4 — Patch

Deploy the applicable Microsoft security updates as quickly as operationally possible.

Step 5 — Verify

Confirm the actual SharePoint farm build after installation.

Step 6 — Hunt

Review logs, endpoint telemetry, web content and network connections for evidence of exploitation.

Step 7 — Contain

If suspicious activity is found, isolate the affected server and begin incident response.

Step 8 — Rotate secrets when appropriate

If compromise is suspected, investigate and rotate affected credentials/secrets according to Microsoft's and your incident-response team's guidance.

Step 9 — Harden

Enable available SharePoint security protections such as AMSI integration and minimize unnecessary Internet exposure. The Canadian Cyber Centre specifically recommends AMSI integration as part of SharePoint hardening.

Final Thoughts

CVE-2026-58644 is a textbook example of why vulnerability management cannot be based on CVSS scores alone.

A 9.8 Critical vulnerability is concerning. A 9.8 Critical vulnerability that requires no authentication, can be exploited remotely, has no user-interaction requirement, and has been added to CISA's KEV catalog because of active exploitation is a fundamentally different operational problem.

Organizations running Microsoft SharePoint Server should therefore treat CVE-2026-58644 as an urgent patch-and-hunt event.

Do not wait for evidence that your SharePoint server has been compromised before taking action.

Patch first. Verify the build. Then investigate whether exploitation occurred before remediation.