The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical Microsoft SharePoint vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on July 16, 2026, signaling active exploitation in the wild. CVE-2026-58644 carries a CVSS 3.1 score of 9.8 and allows unauthenticated remote code execution -- a combination that demands immediate attention from every organization running SharePoint Server.

Vulnerability Details

CVE-2026-58644 is a deserialization of untrusted data vulnerability in Microsoft Office SharePoint Server. An unauthenticated attacker can execute arbitrary code over the network without any user interaction. The CVSS 3.1 vector string tells the complete story:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

Breaking down the base metrics:

• Attack Vector: Network (AV:N) -- exploitable remotely over the internet
• Attack Complexity: Low (AC:L) -- no specialized conditions required
• Privileges Required: None (PR:N) -- unauthenticated exploitation
• User Interaction: None (UI:N) -- no victim action needed
• Scope: Unchanged (S:U) -- impacts the vulnerable component only
• Confidentiality: High (C:H), Integrity: High (I:H), Availability: High (A:H) -- total compromise

The temporal metrics confirm the urgency: Exploit Code Maturity: Functional (E:F) means working exploit code exists. Remediation Level: Official Fix (RL:O) indicates Microsoft has released patches. Report Confidence: Confirmed (RC:C) leaves no doubt about the vulnerability's existence.

Microsoft released the security update on July 14, 2026, with a revision on July 15. CISA added it to the KEV catalog two days later on July 16, giving Federal Civilian Executive Branch (FCEB) agencies until July 19, 2026 -- just three days -- to apply fixes under Binding Operational Directive (BOD) 26-04.

Impact Assessment

This vulnerability affects Microsoft SharePoint Server 2016, 2019, and Subscription Edition. Organizations running any of these versions on internet-accessible infrastructure face immediate risk. The deserialization flaw allows attackers to:

• Achieve full remote code execution as the SharePoint service account
• Access all SharePoint content databases and configuration data
• Move laterally within the network using compromised service accounts
• Deploy persistence mechanisms, ransomware, or data exfiltration tools

Because exploitation requires no authentication and no user interaction, automated scanning and exploitation at scale is trivial. Shodan and Censys queries for internet-facing SharePoint instances will likely reveal thousands of potential targets within hours of the KEV announcement.

Affected Systems

Product	Affected Versions	Fixed Version
SharePoint Server 2016	All builds prior to July 2026 PU	July 2026 Public Update
SharePoint Server 2019	All builds prior to July 2026 PU	July 2026 Public Update
SharePoint Server Subscription Edition	All builds prior to July 2026 PU	July 2026 Public Update

Not affected: SharePoint Online (Microsoft 365) -- Microsoft manages patching for the cloud service. If your organization uses only SharePoint Online, no action is required.

Mitigation and Patching

Immediate action required: Apply the July 2026 Public Update for your SharePoint version. The update is available through:

1. Microsoft Update Catalog -- search for "SharePoint Server 2016 July 2026" (or 2019/Subscription Edition)
2. Windows Server Update Services (WSUS) -- synchronize and approve the security update
3. Microsoft Download Center -- direct download links in the MSRC advisory

Pre-patch mitigation (if immediate patching is impossible):

• Restrict network access to SharePoint servers to trusted IP ranges only
• Disable SharePoint web services not strictly required (e.g., WebDAV, legacy ASMX endpoints)
• Monitor for suspicious deserialization activity in ULS logs and Windows Event Logs (Event ID 1000, .NET Runtime errors)
• Implement network segmentation to limit lateral movement from compromised SharePoint servers

Post-patch verification:

Detection

Organizations should hunt for indicators of exploitation using the following approaches:

Network-based Detection (Suricata/Zeek)

Endpoint Detection (YARA)

Sigma Rule for Windows Event Logs

Frequently Asked Questions

Q: Is this the same as the SharePoint zero-day from July Patch Tuesday (CVE-2026-56164)? A: No. CVE-2026-56164 was a separate SharePoint RCE patched on July 8, 2026 (Patch Tuesday) with CVSS 9.8. CVE-2026-58644 is a distinct deserialization vulnerability disclosed July 14 and added to CISA KEV on July 16. Both require patching.

Q: Does this affect SharePoint Online / Microsoft 365? A: No. Microsoft manages patching for SharePoint Online. Only on-premises SharePoint Server installations are affected.

Q: What if I cannot patch immediately? A: Restrict network access to SharePoint servers to trusted IPs only. Disable unnecessary web services. Monitor ULS logs for deserialization errors. Plan emergency maintenance window within 24 hours.

Q: Are there public exploits available? A: Microsoft rates Exploit Code Maturity as "Functional" -- working exploit code exists. CISA's KEV inclusion confirms active exploitation. Assume weaponized exploits are circulating.

Q: How do I verify the patch is installed? A: Check Get-HotFix for the July 2026 SharePoint Public Update KB number, and verify the Microsoft.SharePoint.dll file version matches the patched build.

Q: What is BOD 26-04 and does it apply to my organization? A: Binding Operational Directive 26-04 mandates FCEB agencies to remediate KEV-listed vulnerabilities on internet-facing assets within specified timelines (3 days for critical). Private organizations are not legally bound but are strongly encouraged to follow the same risk-based approach.

Key Takeaways

1. CVE-2026-58644 is a critical, unauthenticated RCE in SharePoint Server with CVSS 9.8 -- the highest severity tier
2. Active exploitation is confirmed -- CISA added it to the KEV catalog on July 16, 2026, based on observed attacks
3. Patch immediately -- Microsoft released fixes July 14-15; federal agencies have until July 19 under BOD 26-04
4. SharePoint Online is not affected -- only on-premises SharePoint Server 2016, 2019, and Subscription Edition
5. Detection is feasible -- network, endpoint, and log-based rules can catch exploitation attempts
6. This is separate from CVE-2026-56164 -- both SharePoint vulnerabilities from July 2026 require independent patching

Conclusion

CVE-2026-58644 represents the worst-case scenario for on-premises SharePoint deployments: a network-accessible, unauthenticated, zero-interaction remote code execution flaw with functional exploit code and confirmed active exploitation. The three-day federal remediation window under BOD 26-04 underscores the severity. Organizations running affected SharePoint versions should treat this as a drop-everything patching event -- apply the July 2026 Public Update today, verify installation, and deploy detection rules to catch any exploitation attempts that may have already occurred.

---

Sources:

• CISA Adds Three Known Exploited Vulnerabilities to Catalog (July 16, 2026)
• Microsoft Security Update Guide: CVE-2026-58644
• The Hacker News: CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV