Threat Summary

On July 17, 2026, CISA added CVE-2026-58644 — a critical SharePoint Server vulnerability — to its Known Exploited Vulnerabilities catalog, confirming it was weaponized as a zero-day before Microsoft's fix became available. The bug was patched as part of Microsoft's record-breaking July 2026 Patch Tuesday, which addressed 622 CVEs in total.

Microsoft's own advisory describes it plainly: an attacker authenticated as at least a Site Owner can write and remotely execute arbitrary code on the SharePoint Server. Microsoft rates the attack complexity as low — no deep prior knowledge of the target is needed, and the exploit works reliably once attempted.

Who Is Affected?

This affects on-premises SharePoint Server only — not SharePoint Online / Microsoft 365. Confirmed affected versions:

  • Microsoft SharePoint Server Subscription Edition
  • Microsoft SharePoint Server 2019
  • Microsoft SharePoint Enterprise Server 2016

CISA's advisory groups this with three related SharePoint flaws exploited in the same window — CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 — warning that together they enable full remote code execution and post-exploitation activity across all supported on-prem SharePoint versions.

Technical Description

CVE-2026-58644 is a deserialization-of-untrusted-data vulnerability (CWE-502). In practice, this means the server trusts and processes data it shouldn't, letting an attacker smuggle in code that SharePoint then executes on its own server.

The vulnerability requires authentication at the Site Owner level to trigger directly. In real-world attacks, CISA notes this is frequently chained with the related, lower-privilege bugs patched in the same release — including CVE-2026-56164, an unauthenticated elevation-of-privilege flaw that requires no user interaction — giving an attacker a path from zero access to full code execution without ever needing legitimate credentials.

Post-exploitation, CISA specifically flags attackers stealing IIS machine keys — a technique that lets them forge trusted requests and maintain persistent access even after the initial vulnerability is patched, unless the keys themselves are rotated.

Indicators of Compromise (IOCs)

No specific file hashes, IPs, or malware signatures had been publicly published by CISA or Microsoft at the time of writing. CISA's guidance instead focuses on detection technique: scan for machine-key harvesting tools on affected servers before rotating IIS machine keys, and establish tailored logging to catch exploitation and post-exploitation activity. Watch official CISA and MSRC advisories for updates as the investigation continues.

Attack Techniques (MITRE ATT&CK)

  • T1190 — Exploit Public-Facing Application (initial RCE via the deserialization flaw)
  • T1068 — Exploitation for Privilege Escalation (chained via CVE-2026-56164)
  • T1552 — Unsecured Credentials (IIS machine key theft for persistence)

Business Impact

SharePoint Server typically sits at the center of an organization's document management and internal collaboration — meaning a compromise here isn't contained to one app. Full remote code execution on the server gives an attacker a foothold into the wider network, access to potentially sensitive internal documents, and — via stolen IIS machine keys — a way back in even after the original vulnerability is patched, unless keys are properly rotated. For any business running on-prem SharePoint, this is a full incident-response-grade risk, not a routine patch.

Recommended Mitigations

Primary fix: apply Microsoft's July 2026 security updates immediately and confirm every server in the farm is updated — CISA specifically warns against leaving a farm on mixed patch levels.

CISA's official hardening guidance for this threat:

  • Verify Antimalware Scan Interface (AMSI) integration is enabled for every SharePoint web application
  • Scan for and remove intrusion artifacts — including machine-key harvesting tools — before rotating IIS machine keys, or the theft may go undetected
  • Establish tailored logging to detect exploitation and post-exploitation activity
  • Avoid exposing SharePoint Servers directly to the internet unless strictly necessary
  • Block external access to SharePoint Central Administration, and restrict farm/database communications to required systems only

If you manage SharePoint for a client or your own organization and haven't confirmed patch status today, treat this as urgent — federal agencies were given until July 19, 2026 to remediate, which reflects how seriously CISA is treating active exploitation here.

Official Sources