The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Microsoft SharePoint Server vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, signaling that threat actors are actively weaponizing this flaw in the wild. Tracked as CVE-2026-58644, this deserialization vulnerability carries a CVSS 3.1 score of 9.8 and enables unauthenticated remote code execution on exposed SharePoint instances.

Vulnerability Details

CVE-2026-58644 is a critical deserialization of untrusted data vulnerability in Microsoft Office SharePoint. The flaw allows an unauthorized attacker to execute arbitrary code remotely over the network without requiring user interaction or prior authentication.

Key technical characteristics from Microsoft's advisory:

Metric	Value
CVSS 3.1 Base Score	9.8 (Critical)
Attack Vector	Network (AV:N)
Attack Complexity	Low (AC:L)
Privileges Required	None (PR:N)
User Interaction	None (UI:N)
Scope	Unchanged (S:U)
Confidentiality Impact	High (C:H)
Integrity Impact	High (I:H)
Availability Impact	High (A:H)
Exploit Code Maturity	Functional (E:F)
Remediation Level	Official Fix (RL:O)
Report Confidence	Confirmed (RC:C)

The vulnerability stems from insecure deserialization of untrusted data in SharePoint's processing pipeline. An attacker authenticated as at least a Site Owner can write arbitrary code to inject and execute remotely on the SharePoint Server. Microsoft notes the attack complexity is low because:

• No significant prior knowledge of the target system is required
• Repeatable success is achievable with the payload against the vulnerable component

Impact Assessment

This vulnerability poses severe risk to organizations running on-premises SharePoint Server:

What's at risk:

• Full server compromise — Attackers gain remote code execution with the SharePoint service account privileges
• Data exfiltration — Access to all SharePoint content, documents, lists, and configuration data
• Persistence — Post-exploitation activities include stealing IIS machine keys and deploying malware for persistent access
• Lateral movement — Compromised SharePoint servers can serve as footholds for broader network intrusion

Real-world exploitation context: Shadowserver currently tracks nearly 10,000 Internet-exposed Microsoft SharePoint servers, with over 800 unpatched against the earlier CVE-2026-32201 and CVE-2026-45659 vulnerabilities. CVE-2026-58644 was exploited as a zero-day before Microsoft's July 14, 2026 Patch Tuesday release, meaning attackers had a window of opportunity against unpatched systems.

Affected Systems

All supported on-premises SharePoint Server versions are vulnerable:

• Microsoft SharePoint Server Subscription Edition (latest on-premises version with continuous updates)
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Enterprise Server 2016

Note: SharePoint Online (Microsoft 365 cloud service) is not affected — this vulnerability only impacts self-hosted, on-premises deployments. Organizations using SharePoint Online do not need to take action for this specific CVE.

Microsoft has confirmed that the same KB update applies to both SharePoint Server 2016 and SharePoint Enterprise Server 2016.

Mitigation & Patching

Immediate Actions (Priority Order)

1. Apply the July 2026 Patch Tuesday security updates

   • Microsoft released patches for CVE-2026-58644 as part of the July 14, 2026 Patch Tuesday cycle
   • Verify successful installation on all affected SharePoint servers
   • Shorten patching cycles for Internet-exposed systems

2. Enable AMSI (Antimalware Scan Interface) integration

   • Configure AMSI for each SharePoint web application
   • Select "Full Mode" for Request Body Scan Mode where feasible
   • Key AMSI detections to monitor:
     • Exploit:Script/SuspSignoutReqBody.A — request body scanning (Subscription Edition only)
     • Exploit:Script/ToolPaneAuthBypass.A — request header scanning (2016, 2019, Subscription)
     • Exploit:Script/ToolPaneAuthBypass.C — RCE coverage (2016, 2019, Subscription)

3. Rotate IIS machine keys — but hunt first

   • Before rotating keys, scan for and remove intrusion artifacts (machine-key harvesters)
   • Review Microsoft's guidance on improved ASP.NET view state security and key management

4. Implement network segmentation

   • Avoid exposing SharePoint Servers directly to the Internet
   • Place required external access behind a Layer 7 reverse proxy or equivalent application-layer security control
   • Block external access to SharePoint Central Administration
   • Restrict farm and database communications to required systems only

5. Enable enhanced logging and monitoring

   • Establish tailored logging for anomalous requests, suspicious worker-process activity, webshells, and machine-key access
   • Reference CISA's Best Practices for Event Logging and Threat Detection

Federal Agency Deadline

Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch agencies must remediate CVE-2026-58644 by July 19, 2026 (3 days after KEV addition) on publicly exposed assets.

Detection Guidance

Microsoft Defender Antivirus (MDAV) Detections

• Backdoor:MSIL/LeakFang.A!dha — Post-exploitation activity involving IIS-protected secrets

AMSI Detections (SharePoint-specific)

• Exploit:Script/SuspSignoutReqBody.A — Request body scanning (Subscription Edition)
• Exploit:Script/ToolPaneAuthBypass.A — Request header scanning (2016, 2019, Subscription)
• Exploit:Script/ToolPaneAuthBypass.C — RCE coverage (2016, 2019, Subscription)

Sigma Detection Rule (SharePoint ULS Logs)

YARA Rule (Webshell/Malware Artifacts)

Suricata Rule (Network Traffic)

Frequently Asked Questions

Is SharePoint Online (Microsoft 365) affected?

No. This vulnerability only affects on-premises SharePoint Server deployments (Subscription Edition, 2019, 2016). SharePoint Online customers are not impacted and no action is required.

What privilege level does an attacker need?

According to Microsoft, an attacker needs to be authenticated as at least a Site Owner. However, CISA and Microsoft both note the vulnerability was exploited in the wild as a zero-day, suggesting authentication bypass chains may exist or were chained with other flaws (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164).

How do I know if my SharePoint server was compromised?

Monitor for:

• AMSI detections listed above
• MDAV Backdoor:MSIL/LeakFang.A!dha alerts
• Unusual SharePoint worker process (w3wp.exe) behavior
• Unexpected IIS machine key access or rotation
• Webshells in SharePoint web directories (check _layouts, _vti_bin, custom app folders)
• Anomalous outbound connections from SharePoint servers

Can I mitigate without patching immediately?

CISA recommends these interim measures if immediate patching isn't possible:

• Enable AMSI with Full Mode request body scanning
• Block Internet access to SharePoint Central Administration
• Place SharePoint behind a Layer 7 reverse proxy with WAF rules
• Implement the network segmentation and logging recommendations above

However, patching remains the only complete fix. Interim measures reduce risk but don't eliminate the underlying vulnerability.

Are there related vulnerabilities I should patch too?

Yes. CISA's July 14 alert covers four actively exploited SharePoint CVEs:

• CVE-2026-32201 (KEV since April 14, 2026)
• CVE-2026-45659 (KEV since July 1, 2026)
• CVE-2026-56164 (KEV since July 14, 2026)
• CVE-2026-58644 (KEV since July 16, 2026)

Plus CVE-2026-55040 (not yet exploited but flagged by Microsoft as attractive target). Apply the full July 2026 Patch Tuesday update bundle to address all simultaneously.

Key Takeaways

• CVE-2026-58644 is a critical (CVSS 9.8) unauthenticated RCE in on-premises SharePoint Server — actively exploited as a zero-day before the July 14 patch
• CISA added it to the KEV catalog on July 16, 2026 — federal agencies have until July 19 to patch; all organizations should treat this as urgent
• ~10,000 Internet-exposed SharePoint servers exist globally — over 800 remain unpatched against earlier related flaws, making them prime targets
• Patching is non-negotiable — apply the July 2026 Patch Tuesday updates immediately and verify installation
• Defense-in-depth matters — enable AMSI, segment networks, rotate machine keys (after hunting for artifacts), and implement tailored logging
• This is the 11th SharePoint vulnerability added to KEV since November 2021 — 7 of 11 were used in ransomware attacks; on-premises SharePoint remains a high-value target

Conclusion

CVE-2026-58644 represents a textbook example of why Internet-exposed on-premises SharePoint deployments require rigorous patch management and network hardening. The vulnerability's critical severity, zero-day exploitation history, and CISA KEV designation create a perfect storm — organizations running affected SharePoint versions must prioritize immediate patching and implement the layered defenses CISA recommends. The window for "later" has closed; active exploitation means every unpatched hour increases compromise probability.

---

Sources:

• CISA Adds Three Known Exploited Vulnerabilities to Catalog (July 16, 2026)
• CISA Urges SharePoint Hardening After New Exploitations (July 14, 2026)
• Microsoft Security Update Guide: CVE-2026-58644
• The Hacker News: CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
• BleepingComputer: CISA Warns Admins to Patch Actively Exploited SharePoint Flaws