On July 16, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the CVE-2026-58644 vulnerability in Microsoft SharePoint Server to the Known Exploited Vulnerabilities (KEV) catalog. The vulnerability has a critical CVSS score of 9.8, enables remote arbitrary code execution via deserialization of untrusted data, and had already been exploited by attackers before a patch was released. U.S. federal civilian agencies are required to apply fixes by July 19, 2026. All organizations running on‑premises SharePoint Server instances are strongly urged to immediately deploy the updates from the July 14, 2026 Patch Tuesday.
Technical characteristics of CVE-2026-58644
According to the Microsoft advisory, CVE-2026-58644 is a deserialization of untrusted data vulnerability (CWE-502). In a network attack scenario, an attacker authenticated with at least Site Owner privileges can inject and remotely execute arbitrary code on the SharePoint server.
Microsoft rates the attack complexity as low for two reasons:
- The attacker does not need significant prior knowledge of the target system.
- The attacker can reliably achieve success with a payload against the vulnerable component.
The vulnerability affects all supported on‑premises versions of SharePoint Server:
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Enterprise Server 2016
Fixes were released as part of the July 14, 2026 Patch Tuesday updates. Microsoft later updated the advisory, confirming that CVE-2026-58644 had been exploited in real‑world attacks. This means the vulnerability was used as a zero-day — before the patch became available.
Campaign scope: not a single bug, but an attack chain
CVE-2026-58644 is not an isolated issue. On July 14, CISA warned about active exploitation of several SharePoint Server vulnerabilities at once: CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644. All of them target on‑premises SharePoint instances and are being used together.
According to CISA, the attack chain includes:
- Remote code execution (RCE) as the initial intrusion vector.
- Post-exploitation activity — theft of IIS (Internet Information Services) machine keys.
- Use of deserialization techniques to maintain persistence in the system and deploy malware.
The theft of IIS machine keys deserves special attention: these keys are used to protect ViewState data in ASP.NET applications. Once obtained, an attacker can forge ViewState, bypass authentication mechanisms, and retain access to the compromised environment even after patches are applied — if the keys have not been rotated.
Impact assessment
The highest risk is to organizations running on‑premises SharePoint Server instances exposed to the internet. SharePoint is widely used in government agencies, the financial sector, healthcare, and large enterprises for document collaboration, content management, and internal portals.
The criticality of the situation is determined by a combination of factors: a CVSS score of 9.8, low exploitation complexity, confirmed use in real‑world attacks, and the presence of a full chain of vulnerabilities that enable not only initial access but also persistence. Organizations that have not applied the patch and have not rotated their IIS keys risk full compromise of their SharePoint server infrastructure, data leakage, and deployment of malware across the corporate network.
Security recommendations
CISA has published a detailed list of measures to harden SharePoint Server:
- Immediately install the updates from the July 14, 2026 Patch Tuesday. Verify that patches have been successfully applied and, where possible, shorten your patching cycles.
- Verify that AMSI (Antimalware Scan Interface) integration is enabled for each SharePoint web application. Configuration guidance is available on the Microsoft Learn portal.
- Search for and remove intrusion artifacts, including tools used to collect machine keys, before rotating IIS keys. Rotating keys without prior cleanup will result in compromise of the new keys.
- Configure targeted logging to detect and monitor exploitation attempts.
- Do not publish SharePoint Server directly to the internet unless it is absolutely necessary.
- Block external access to SharePoint Central Administration and restrict communications between the farm and databases to only the systems that require it. Review Microsoft’s SharePoint Server security hardening guidance to configure ports, services, and Web.config settings by role.
Additionally: Fortinet FortiSandbox vulnerabilities
On the same day, CISA added two critical vulnerabilities in Fortinet FortiSandbox — CVE-2026-25089 and CVE-2026-39808 — to the KEV catalog. The remediation deadline for federal agencies is also July 19, 2026. Organizations using FortiSandbox should update their instances to the latest supported versions.
The SharePoint Server situation requires more than just installing a patch; it demands a comprehensive response. Given the confirmed exploitation in real‑world attacks and the use of a chain of multiple vulnerabilities to gain persistence in the infrastructure, it is critically important to complete the full cycle: deploy updates, search for signs of compromise, remove intrusion artifacts, rotate IIS machine keys, and restrict network access to SharePoint servers. Organizations that discover indications of compromise should treat the incident as a full‑scale intrusion and respond accordingly.
