The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a newly patched critical vulnerability impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, tracked as CVE-2026-58644, carries a maximum CVSS score of 9.8 and has been actively exploited in the wild as a zero-day prior to patches becoming available. Federal Civilian Executive Branch agencies must apply fixes by July 19, 2026, and all organizations running on-premises SharePoint should treat this as an emergency patching priority.

Vulnerability Details

CVE-2026-58644 is a critical deserialization of untrusted data vulnerability in Microsoft SharePoint Server. An authenticated attacker with at least Site Owner permissions can write arbitrary code to inject and execute commands remotely on the SharePoint Server. Microsoft's advisory notes the vulnerability is remotely exploitable over the internet with low attack complexity for two reasons:

• An attacker does not require significant prior knowledge of the target system
• An attacker can achieve repeatable success with the payload against the vulnerable component

The vulnerability affects all supported on-premises SharePoint Server versions:

• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Enterprise Server 2016

Patches were released as part of the July 2026 Patch Tuesday updates on July 14, 2026. Microsoft subsequently revised its bulletin to confirm CVE-2026-58644 was exploited in the wild before fixes were available, confirming its zero-day status.

Impact Assessment

This vulnerability enables unauthenticated remote code execution on SharePoint servers, which often host sensitive corporate documents, intranet portals, and business-critical workflows. CISA warns that threat actors are actively exploiting multiple SharePoint Server vulnerabilities in combination, including CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644.

Post-exploitation activities observed include:

• Stealing Internet Information Services (IIS) machine keys
• Performing deserialization techniques to gain persistence
• Deploying malware and maintaining long-term access

The ability to harvest IIS machine keys is particularly dangerous, as it allows attackers to forge authentication tokens and escalate privileges across the SharePoint farm.

Affected Systems

Any organization running on-premises SharePoint Server is at risk, specifically:

• SharePoint Server Subscription Edition (all versions prior to July 2026 Patch Tuesday)
• SharePoint Server 2019 (all versions prior to July 2026 Patch Tuesday)
• SharePoint Enterprise Server 2016 (all versions prior to July 2026 Patch Tuesday)

SharePoint Online (cloud) is not affected. Organizations using hybrid configurations should verify their on-premises components are patched.

Mitigation & Patching

Immediate Actions (Complete by July 19, 2026):

1. Apply July 2026 Patch Tuesday Updates Download and install the security updates for your SharePoint version from the Microsoft Update Catalog or via WSUS/SCCM. The updates are cumulative; installing the latest CU includes all previous fixes.

2. Verify Patch Installation After patching, verify the build number matches the patched version for your SharePoint edition. Run Get-SPFarm | Select BuildVersion in the SharePoint Management Shell.

3. Enable Antimalware Scan Interface (AMSI) Integration Ensure AMSI integration is enabled for each SharePoint web application. This provides runtime detection of malicious deserialization payloads. Configure via PowerShell:

   powershell

4. Scan for Intrusion Artifacts Before rotating IIS machine keys, scan for and remove machine key harvesting tools and other intrusion artifacts. Use Microsoft Defender for Endpoint or your EDR solution to hunt for:

   • Suspicious PowerShell scripts targeting Microsoft.SharePoint.Administration.SPMachineKey
   • Unusual file writes to the SharePoint configuration directory
   • Anomalous w3wp.exe child processes

5. Rotate IIS Machine Keys After confirming no active compromise, rotate IIS machine keys across the SharePoint farm to invalidate any stolen keys:

   powershell

6. Implement Network Segmentation

   • Avoid exposing SharePoint Servers directly to the internet unless absolutely necessary
   • Block external access to SharePoint Central Administration
   • Restrict farm and database communications to required systems only
   • Review Microsoft's SharePoint Server security-hardening guidance for role-specific ports, services, and Web.config settings

7. Establish Tailored Logging Configure enhanced logging to detect exploitation attempts:

   • Enable SharePoint ULS logging at Verbose level for Microsoft.SharePoint.Administration
   • Monitor IIS logs for POST requests to /_vti_bin/ endpoints with unusual payloads
   • Alert on Event ID 1309 (ASP.NET unhandled exceptions) with deserialization stack traces

Detection

Organizations should hunt for indicators of compromise using the following queries:

KQL (Microsoft Defender / Sentinel):

Splunk:

Key IOCs to Monitor:

• Unexpected MachineKey access in ULS logs
• New files in C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\CONFIG\
• Unusual SPWebConfigModification entries
• Authentication anomalies for service accounts

Frequently Asked Questions

Q: Does this affect SharePoint Online (Microsoft 365)? A: No. CVE-2026-58644 only affects on-premises SharePoint Server versions. SharePoint Online is managed and patched by Microsoft automatically.

Q: What if I cannot patch by July 19? A: If immediate patching is not possible, implement compensating controls: restrict Central Administration to internal IPs only, enable AMSI, block internet-facing access, and increase monitoring. However, patching remains the only complete fix.

Q: How do I know if I've already been compromised? A: Run the detection queries above. Look for stolen IIS machine keys (check for unauthorized SPMachineKey access), unexpected farm configuration changes, and malware in the SharePoint hive directory. Engage your IR team if artifacts are found.

Q: Are there public exploits available? A: CISA's KEV addition confirms active exploitation in the wild. While full weaponized exploits may not be public, the vulnerability's low complexity means capable actors can develop reliable exploits quickly.

Q: Does this vulnerability require authentication? A: Yes, the attacker needs at least Site Owner permissions. However, compromised low-privilege accounts or social engineering can provide this access. The vulnerability is then used to escalate to server-level RCE.

Q: What about the other SharePoint CVEs CISA mentioned? A: CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 are also actively exploited. The July 2026 Patch Tuesday addresses all four. Apply the cumulative update to remediate all simultaneously.

Key Takeaways

• CVE-2026-58644 is a critical (CVSS 9.8) SharePoint RCE actively exploited as a zero-day
• Patch deadline: July 19, 2026 for federal agencies; immediately for all others
• Affects all on-premises SharePoint versions: Subscription Edition, 2019, 2016
• Attackers chain this with other SharePoint CVEs for full farm compromise
• IIS machine key theft enables persistence; rotate keys after patching
• Enable AMSI integration and restrict internet exposure as defense-in-depth
• The July 2026 Patch Tuesday (July 14) contains fixes for all four actively exploited SharePoint CVEs

Conclusion

CVE-2026-58644 represents a severe risk to any organization running on-premises SharePoint. The combination of maximum severity, confirmed active exploitation, low attack complexity, and the central role of SharePoint in enterprise document management makes this a patch-now scenario. The July 19 deadline for federal agencies should be treated as the de facto deadline for all organizations. Apply the July 2026 Patch Tuesday updates immediately, enable AMSI, rotate IIS machine keys, and implement network segmentation to contain the threat.

---

Sources:

• CISA Alert: CISA Adds Three Known Exploited Vulnerabilities to Catalog
• Microsoft Security Advisory: CVE-2026-58644
• The Hacker News: CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
• CISA: Urges SharePoint Hardening After New Exploitations