CVE-2026-58644
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Description
CVE-2026-58644 is a critical deserialization of untrusted data vulnerability in Microsoft Office SharePoint that allows an unauthenticated attacker to execute arbitrary code over the network. Rated CVSS 9.8 (Critical), the flaw affects Microsoft SharePoint Server 2016, 2019, and Subscription Edition builds prior to 16.0.19725.20434. Because the vulnerable deserialization logic processes attacker-controlled data without authentication or user interaction, a successful exploit gives the attacker full control over the confidentiality, integrity, and availability of the SharePoint server. CISA has added CVE-2026-58644 to its Known Exploited Vulnerabilities (KEV) catalog with a remediation due date of 2026-07-19, confirming that this SharePoint vulnerability is being actively exploited in the wild and demands immediate patching.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | sharepoint server | < 16.0.19725.20434; 2016; 2019 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
Deserialization of Untrusted Data occurs when an application reconstructs objects from serialized data received from an untrusted source without sufficiently verifying that the resulting data is valid and safe. In Microsoft SharePoint, this weakness allows a remote attacker who controls serialized input to instantiate arbitrary objects and trigger dangerous operations during deserialization, ultimately leading to remote code execution on the server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
With a CVSS 3.1 base score of 9.8 (Critical), CVE-2026-58644 represents a worst-case scenario for exposed SharePoint deployments: the vulnerability is remotely exploitable without physical access, easy to exploit with no special conditions needed, requires no authentication, and needs no user action. Confidentiality (High): an attacker can read documents, credentials, and configuration data stored on the SharePoint server, which frequently includes an organization's most sensitive internal files. Integrity (High): attackers can modify or plant content and code, turning a collaboration platform into a distribution point for further compromise. Availability (High): full code execution allows an attacker to disrupt or disable the SharePoint service entirely. Since SharePoint servers are often reachable from the internet or from broad internal network segments, and CISA has confirmed active exploitation, the practical business risk is severe even though the current EPSS score of about 1.5% is still moderate.
Exploit Maturity
CVE-2026-58644 is listed in CISA's Known Exploited Vulnerabilities catalog, which means active exploitation in the wild has been confirmed; ransomware use is currently marked as Unknown. No public exploit code is linked in the available references — the only published sources are the Microsoft advisory and the CISA KEV entry — but the KEV listing alone warrants treating this as an act-now vulnerability. The EPSS score of 1.47% (70.8th percentile) suggests exploitation is not yet broadly automated, yet confirmed in-the-wild activity against an unauthenticated remote code execution flaw in SharePoint makes rapid patching before the 2026-07-19 KEV deadline essential.
Remediation
- Follow the CISA KEV required action: "Apply mitigations in accordance with vendor instructions", ensuring compliance with CISA's BOD 26-04 risk-based patching guidance and CISA's Forensics Triage Requirements — and discontinue use of the product if mitigations are unavailable. The KEV due date is 2026-07-19.
- Install the Microsoft security update referenced in the MSRC advisory for CVE-2026-58644. Update SharePoint Server to build 16.0.19725.20434 or later, and apply the corresponding patches for SharePoint Server 2016 and 2019.
- Until patching is complete, restrict network exposure of SharePoint: remove direct internet access where possible, enforce access via VPN or a reverse proxy with authentication, and segment SharePoint servers from untrusted networks.
- Perform forensic triage on all affected servers in line with CISA's guidance: review IIS and SharePoint ULS logs for anomalous requests and unexpected child processes, and check for newly created files or web shells, since the vulnerability is known to be exploited in the wild.
- As long-term hardening against deserialization flaws (CWE-502), avoid exposing endpoints that deserialize untrusted input, implement integrity checks such as HMAC or digital signatures on serialized data, and restrict which classes may be deserialized via allowlists.
Technical Details
The root cause of CVE-2026-58644 is unsafe deserialization (CWE-502) in Microsoft Office SharePoint: the application reconstructs objects from serialized data that an attacker can supply over the network, without adequately validating that the resulting object graph is safe. When attackers control serialized data, they can manipulate it to instantiate arbitrary objects, set malicious property values, or trigger dangerous operations during the deserialization process — in .NET-based products like SharePoint this typically culminates in arbitrary code execution in the context of the application. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H captures why this is so dangerous: the attack arrives over the network (AV:N), requires no special conditions (AC:L), no privileges (PR:N), and no user interaction (UI:N), while fully compromising confidentiality, integrity, and availability of the vulnerable SharePoint server. The scope remains unchanged (S:U), meaning the direct impact is on the SharePoint component itself, though code execution on a collaboration server naturally provides a strong pivot point into the wider environment.
Frequently Asked Questions
Is CVE-2026-58644 being actively exploited?
Yes. CVE-2026-58644 is listed in CISA's Known Exploited Vulnerabilities catalog, which confirms active exploitation in the wild, with a federal remediation deadline of 2026-07-19. Ransomware usage is currently marked as Unknown, and the EPSS score of about 1.5% places it in the 71st percentile of all CVEs.
What products are affected by CVE-2026-58644?
The vulnerability affects Microsoft SharePoint Server, specifically SharePoint Server 2016, SharePoint Server 2019, and builds prior to version 16.0.19725.20434. Organizations running any on-premises SharePoint Server deployment should verify their build number and patch status.
How do I fix CVE-2026-58644?
Apply the Microsoft security update referenced in the MSRC update guide for CVE-2026-58644, bringing SharePoint Server to build 16.0.19725.20434 or later or the corresponding patched builds for 2016 and 2019. Until patched, restrict network exposure of SharePoint servers and review logs for signs of compromise, following CISA's BOD 26-04 and forensics triage guidance.
How severe is CVE-2026-58644?
CVE-2026-58644 is rated Critical with a CVSS 3.1 base score of 9.8, the near-maximum rating. It allows unauthenticated remote code execution with high impact on confidentiality, integrity, and availability, and its presence in the CISA KEV catalog confirms it is exploited in practice, not just in theory.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.