CVE-2026-58644

CVE-2026-58644 is a critical (CVSS 9.8) deserialization-of-untrusted-data flaw (CWE-502) in Microsoft SharePoint Server that allows an unauthorized attacker to execute code over a network. An attacker triggers it by sending crafted serialized data to the server, with no privileges or user interaction required, gaining code execution in the context of the SharePoint service. Any organization running on-premises SharePoint Server is affected, with highest risk for instances reachable from the internet or by untrusted network users. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-07-16, and contemporaneous headlines describe an exploited SharePoint zero-day, indicating active in-the-wild exploitation; EPSS assigns a roughly 16% probability of exploitation within 30 days (97th percentile). Fixes shipped in Microsoft's July 2026 Patch Tuesday release (621 CVEs total), while no public proof-of-concept for this specific CVE is documented.

What to do: Apply Microsoft's July 2026 Patch Tuesday security updates for SharePoint Server immediately, prioritizing internet-facing instances, as required for federal agencies under CISA BOD 26-04 and the KEV listing. If patching must be delayed, restrict network exposure to SharePoint per Microsoft/CISA mitigation guidance and assess each asset's internet exposure. Review SharePoint and web-server logs for signs of exploitation and enumerate all SharePoint Server installations in the environment to confirm coverage.