Microsoft SharePoint Server faces an actively exploited critical vulnerability that lets unauthenticated attackers execute arbitrary code remotely. CISA added CVE-2026-58644 to its Known Exploited Vulnerabilities catalog on July 16 2026 with a July 19 deadline for federal agencies to patch.

Vulnerability Details

CVE-2026-58644 carries a CVSS 3.1 score of 9.8 (Critical). The flaw is a deserialization of untrusted data vulnerability (CWE-502) in Microsoft Office SharePoint. An unauthorized attacker can execute code over the network without requiring user interaction or privileges.

The attack vector is network-based (AV:N) with low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). The scope is unchanged (S:U) with high impact to confidentiality integrity and availability (C:H/I:H/A:H).

Microsoft rates the vulnerability as Critical and notes it is remotely exploitable over the internet. The attack complexity is low because an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload.

Impact Assessment

Successful exploitation allows remote code execution on the SharePoint Server with the permissions of the SharePoint application pool account. This typically provides SYSTEM-level access on the host.

The vulnerability affects all supported on-premises SharePoint Server versions:

• Microsoft SharePoint Server Subscription Edition (versions prior to 16.0.19725.20434)
• Microsoft SharePoint Server 2019 (versions prior to 16.0.10417.20153)
• Microsoft SharePoint Enterprise Server 2016 (versions prior to 16.0.5556.1005)

SharePoint Online and Microsoft 365 are not affected.

CISA warns that threat actors chain this vulnerability with others including CVE-2026-32201 CVE-2026-45659 and CVE-2026-56164 to establish persistence steal IIS machine keys and deploy malware. Post-exploitation activity includes machine key harvesting and deserialization techniques for persistence.

Affected Systems

Any organization running on-premises SharePoint Server Subscription Edition 2019 or 2016 is at risk. Internet-exposed SharePoint servers face the highest risk. CISA specifically advises against exposing SharePoint servers directly to the internet unless absolutely necessary.

Mitigation and Patching

Microsoft released patches for CVE-2026-58644 as part of the July 14 2026 Patch Tuesday updates. Apply the latest cumulative update for your SharePoint version immediately.

For Federal Civilian Executive Branch agencies CISA Binding Operational Directive 22-01 requires remediation by July 19 2026. All other organizations should treat this as an emergency patch.

Additional hardening measures from CISA:

• Enable Antimalware Scan Interface (AMSI) integration for each SharePoint web application
• Scan for and remove intrusion artifacts including machine key harvesting tools before rotating IIS machine keys
• Establish tailored logging to detect and monitor exploitation activities
• Avoid exposing SharePoint Servers directly to the internet unless necessary
• Block external access to SharePoint Central Administration restrict farm and database communications to required systems
• Review Microsoft SharePoint Server security-hardening guidance for role-specific ports services and Web.config settings

Detection

Monitor for the following indicators:

• Unusual deserialization activity in SharePoint logs
• Unexpected IIS machine key rotation or access
• Suspicious child processes spawned by SharePoint application pools
• Network connections from SharePoint servers to unusual destinations
• Authentication anomalies including machine key theft patterns

CISA and Microsoft recommend establishing tailored logging mechanisms to detect and monitor exploitation activities.

Frequently Asked Questions

Is SharePoint Online affected?

No. SharePoint Online and Microsoft 365 are not affected by this vulnerability.

What is the CVSS score?

CVSS 3.1 base score of 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Has this been exploited in the wild?

Yes. CISA added CVE-2026-58644 to the Known Exploited Vulnerabilities catalog on July 16 2026 confirming active exploitation. Microsoft revised its advisory to confirm the flaw was weaponized as a zero-day prior to patches.

What versions are vulnerable?

SharePoint Server Subscription Edition before 16.0.19725.20434 SharePoint Server 2019 before 16.0.10417.20153 and SharePoint Enterprise Server 2016 before 16.0.5556.1005.

Are there workarounds?

No complete workarounds exist. CISA recommends enabling AMSI limiting internet exposure and monitoring for indicators of compromise. Patching is the only complete remediation.

What is the CISA deadline?

Federal Civilian Executive Branch agencies must patch by July 19 2026 per Binding Operational Directive 22-01.

Key Takeaways

• CVE-2026-58644 is a critical deserialization RCE in on-premises SharePoint Server CVSS 9.8
• Actively exploited in the wild added to CISA KEV catalog July 16 2026
• Federal agencies must patch by July 19 2026 all organizations should treat as emergency
• Affects SharePoint Server Subscription Edition 2019 and 2016 all supported versions
• Threat actors chain with CVE-2026-56164 CVE-2026-32201 CVE-2026-45659 for persistence
• Enable AMSI limit internet exposure monitor for machine key theft and suspicious child processes
• No workarounds exist patching is mandatory

---

Sources:

• CISA Known Exploited Vulnerabilities Catalog CVE-2026-58644
• Microsoft Security Update Guide CVE-2026-58644
• The Hacker News CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
• NVD CVE-2026-58644 Detail
• CISA Alert AA26-197A CISA Urges SharePoint Hardening After New Exploitations