Remote code execution vulnerability in Microsoft SharePoint: risks and protection

CVE-2026-58644 is a remote code execution vulnerability in Microsoft SharePoint related to deserialization of untrusted data that is already being exploited in the wild. Network access from an unauthorized attacker is sufficient to carry out the attack, which makes it a critical risk for all organizations that use SharePoint as an internal or externally accessible corporate portal. The top priority should be the immediate updating of instances in line with Microsoft’s recommendations and restricting network access to SharePoint until the vulnerability has been fully remediated.

Technical details of the vulnerability

According to the description from the Microsoft Security Response Center, the CVE-2026-58644 vulnerability affects Microsoft Office SharePoint and is related to the deserialization of untrusted data. An error in processing incoming data allows an attacker to send specially crafted data over the network which, during deserialization, leads to arbitrary code execution on the SharePoint server.

Key characteristics of the vulnerability, based on the official description:

• type: remote code execution (RCE);
• component: Microsoft Office SharePoint;
• root cause: deserialization of untrusted data;
• vector: network, exploitable by an unauthorized attacker;
• status according to Microsoft: exploitation has been observed in current software versions.

Deserialization is the process of converting structured data (objects, messages) from a text or binary representation back into in-memory objects. If a deserialization mechanism processes client-supplied data without strict validation and type restrictions, an attacker can inject a sequence of data that, when the object is reconstructed, triggers unwanted operations — up to and including execution of arbitrary commands.

In the context of SharePoint, this means that a vulnerable component receiving data over the network (for example, in the request body or a specific field) can become an attack entry point. After successful exploitation, the attacker’s code typically runs with the permissions of the application pool account or the SharePoint service account, which in a typical configuration provides at least access to site content and often to broader resources on the server.

The fact that exploitation has been confirmed by Microsoft in the vulnerability entry for CVE-2026-58644 moves it out of the category of purely theoretical risks: attackers already have working methods for exploiting this flaw against real-world systems.

Threat context and place in the attack chain

Publicly accessible corporate portals and collaboration systems have traditionally been a priority target for attackers. A vulnerability that enables remote code execution in SharePoint via a network interface without prior authentication perfectly fits the Exploit Public-Facing Application (T1190) technique in MITRE ATT&CK — compromising an internet-facing application to gain an initial foothold in the infrastructure.

A typical scenario for exploiting a vulnerability of this class looks like this:

• an automated scanner discovers externally accessible SharePoint instances;
• a set of generated requests with malicious data for deserialization is sent to each of them;
• upon successful exploitation, a loader or a “one-liner” script is uploaded and executed on the server to provide remote access (reverse connection, web shell, implanting a management agent);
• the attackers then use the compromised SharePoint server to reconnoiter the domain environment, steal data, and deploy ransomware or other payloads.

Since Microsoft has explicitly noted that CVE-2026-58644 is being exploited, both targeted attacks and large-scale automated scanning aimed at mass discovery of vulnerable instances can be expected.

Impact assessment for organizations

Who is at highest risk:

• organizations that publish SharePoint to the internet without an additional protection layer (VPN, gateways, strict access policies);
• environments where SharePoint is the central hub for document management and integrations with other business systems;
• setups where SharePoint service accounts have excessive privileges at the domain and file resource level.

Potential consequences of a successful attack:

• an attacker gaining control over the SharePoint server and all sites and documents hosted on it;
• compromise of user accounts that rely on SharePoint through content tampering, script injection, or phishing pages inside the portal;
• further attack progression inside the network: attempts at lateral movement, establishing additional backdoors, and privilege escalation;
• disruption of business processes tied to SharePoint (contracts, requests, approvals), up to a complete outage of certain departments;
• leakage of confidential information and personal data, with compliance implications and potential regulatory fines.

Given that SharePoint is often integrated with email systems, CRM, ERP, and file repositories, compromising this node can become the starting point of a large-scale incident affecting several critical systems at once.

Practical security recommendations

1. Immediate updating of vulnerable systems

• Inventory all Microsoft SharePoint instances (including test and pilot environments), especially those that are reachable from external segments or the internet.
• Use the Microsoft portal to clarify product status and available updates for CVE-2026-58644. The patch for this vulnerability should be treated as top priority.
• Before deploying updates, prepare a rollback plan and perform testing on non-production servers, but do not delay rolling them out to production environments.

To assess overall criticality and align with internal vulnerability management procedures, you can use data from the NVD for CVE-2026-58644, where the vulnerability will be classified in terms of risk metrics.

2. Reducing the attack surface until patches are installed

If immediate installation of updates is difficult (dependencies, maintenance windows), temporarily reduce the exposure of the vulnerable service:

• restrict access to SharePoint from the internet: where possible, move access to the internal perimeter or behind a VPN, and apply allowlists of IP addresses;
• place SharePoint behind a reverse proxy or application gateway with inbound traffic inspection and additional authentication enabled;
• review the permissions of SharePoint and IIS service accounts: remove excessive privileges that could be abused if the server is compromised;
• enable or tighten security controls at the server level (antivirus, EDR), including blocking execution of unknown binaries and scripts from temporary and non-standard directories.

3. Detecting possible exploitation

Given the confirmed exploitation, it is important not only to close the vulnerability but also to check whether the system has already been compromised.

• Analyze IIS and SharePoint logs for the period when vulnerable versions might have been exposed: look for anomalous requests, large request bodies, unusual headers, or repeated access from the same IP addresses.
• Check Windows event logs for:
  • unusual process launches under SharePoint service accounts or IIS application pool identities;
  • creation of new services, scheduled tasks, or changes to autostart parameters;
  • Suspicious file operations in SharePoint directories and temporary folders.
• Compare the current set of SharePoint site templates, solutions, and extensions with a baseline: the appearance of unknown modules or pages may indicate successful exploitation.
• If you have an intrusion detection system or EDR, configure searches for the relevant timeframes and SharePoint servers for commands typical of post-compromise activity (gathering domain information, creating new accounts, etc.).

If signs of compromise are found, you should assume full server takeover, followed by forensic analysis and, if necessary, rebuilding the instance from trusted sources.

4. Long-term measures for managing deserialization risk

• Introduce regular reviews of the architecture and configuration of server applications for the use of data deserialization mechanisms, especially in components that process external requests.
• Increase the priority of vulnerabilities explicitly related to deserialization of untrusted data in your vulnerability management policy: such flaws often lead to full host compromise.
• Update training materials and awareness programs for developers and administrators, focusing on secure handling of incoming data and common deserialization exploitation patterns.

The critical takeaway regarding CVE-2026-58644 is that the vulnerability is already being used by attackers against real Microsoft SharePoint instances. Organizations therefore need to apply the fixes recommended by Microsoft in the next maintenance window, while simultaneously limiting external access to SharePoint and performing a retrospective analysis of server logs and configurations for signs of possible compromise.