🔴 CVE-2026-58644

CVE-2026-58644 is a critical unauthenticated remote code execution vulnerability in on-premises Microsoft SharePoint Server caused by deserialization of untrusted data (CWE-502). It allows an unauthenticated network attacker to execute arbitrary code directly on the SharePoint server, resulting in full server compromise. The flaw is actively exploited in the wild and listed in CISA KEV.

← Back to Overview
HIGH_RISK
Risk Level
9.8
CVSS Score
NETWORK
Attack Vector
Initial Access
ATT&CK Tactic
T1190 — Exploit Public-Facing Application
ATT&CK Technique
HIGH
Deployment Risk
No
Ransomware

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-07-14

Added to CISA KEV: 2026-07-16 2 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-58644 is a critical remote code execution (RCE) vulnerability affecting on-premises deployments of Microsoft SharePoint Server. The flaw stems from the insecure deserialization of untrusted data, allowing an unauthorized attacker to execute arbitrary code on a vulnerable server over the network. Because the vulnerability can be triggered without authentication or user interaction, it represents a significant security risk for organizations relying on SharePoint infrastructure.

Exploitation

  • Active Exploitation: The vulnerability has been exploited in the wild as a zero-day prior to the release of official security patches [1][3].
  • Threat Actors: While active exploitation has been confirmed and the vulnerability is listed on CISA's Known Exploited Vulnerabilities (KEV) Catalog, specific names of threat actors or ransomware campaigns linked to the initial zero-day exploitation have not been publicly attributed in reports [1][3].
  • Availability: Public proof-of-concept (PoC) or exploit tool information is known to exist, as security research entities have analyzed the mechanics of the deserialization flaw [4][5].
  • Prerequisites: The attack is network-based and does not require authentication, user interaction, or local access to the server to execute successfully [2].

Affected Products & Patches

  • Affected Products: All supported on-premises editions of Microsoft SharePoint Server are affected by this vulnerability [2][3].
  • Patch Availability: Security updates were released by Microsoft in June 2026 to address the vulnerability [2].
  • Mitigations: Organizations are strongly advised to avoid exposing SharePoint servers directly to the internet; if exposure is necessary, deploying a Layer 7 reverse proxy or similar application-layer security control is recommended to help enforce security policies [1].

Impact

  • Access/Capability: Successful exploitation provides an attacker with the ability to execute arbitrary code on the server, potentially leading to full system compromise.
  • Business Risk: Internet-facing deployments face an extreme risk, as the vulnerability allows unauthenticated, remote actors to gain control over the SharePoint server, which may lead to data breaches, lateral movement within the network, or the deployment of persistent malware and ransomware.

Sources

  1. CISA Urges SharePoint Hardening After New Exploitations

    CISA has updated this Alert to reflect the addition of CVE-2026-58644 to its KEV Catalog on July 16, 2026. Avoid exposing SharePoint Servers directly to the internet. If exposure is unavoidable, require a Layer 7 reverse proxy or equivalent application-layer security control that enforces ...

  2. CVE-2026-58644: Patch Critical SharePoint RCE With June Updates

    Microsoft has disclosed CVE-2026-58644, a critical unauthenticated remote code execution vulnerability affecting supported on-premises editions of SharePoint Server. The flaw carries a CVSS 3.1 base score of 9.8 and can reportedly be exploited over a network without credentials or user...

  3. CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV

    CISA says SharePoint CVE-2026-58644 was exploited before Microsoft patched it, affecting all supported on-premises versions and enabling RCE.

  4. CVE-2026-58644: SharePoint Deserialization RCE, KEV ...

    CVE-2026-58644 is a critical remote code execution vulnerability in on-premises Microsoft SharePoint Server. Microsoft describes the flaw as deserialization ...

  5. CVE-2026-58644: Microsoft SharePoint Server ...

    CVE-2026-58644, a critical remote code execution (RCE) vulnerability affecting on-premises Microsoft SharePoint Server deployments.

Generated by PatchNow Intelligence System

Analysis based on CIRCL.LU data, Claude AI assessment, and MITRE ATT&CK framework

📄 Download JSON Data | 📡 RSS Feed