CVE-2026-58644 Overview
CVE-2026-58644 is a critical insecure deserialization vulnerability in Microsoft Office SharePoint Server. The flaw allows an unauthenticated attacker to execute arbitrary code over a network by submitting crafted serialized data to a vulnerable SharePoint endpoint. The weakness is classified as [CWE-502] Deserialization of Untrusted Data.
Microsoft published the advisory on July 14, 2026, and CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. The vulnerability affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016.
Critical Impact
Unauthenticated attackers can achieve remote code execution on SharePoint servers with no user interaction, leading to full compromise of collaboration infrastructure and sensitive corporate data.
Affected Products
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server 2016 Enterprise
Discovery Timeline
- 2026-07-14 - CVE-2026-58644 published to NVD
- 2026-07-17 - Last updated in NVD database
- 2026-07-20 - EPSS score recorded at 1.465% (70.774 percentile)
Technical Details for CVE-2026-58644
Vulnerability Analysis
CVE-2026-58644 is an insecure deserialization vulnerability in Microsoft Office SharePoint. SharePoint processes serialized object data received from network requests without adequately validating its type or contents. Attackers can craft malicious serialized payloads that, when deserialized by the server, instantiate gadget chains that lead to arbitrary code execution.
The vulnerability is reachable over the network without authentication and without user interaction. Successful exploitation grants the attacker code execution in the context of the SharePoint application pool, typically a privileged service account with broad access to site collections, configuration databases, and integrated identity systems.
CISA lists CVE-2026-58644 in its KEV catalog, confirming exploitation in the wild. The EPSS score of 1.465% places it in the 70th percentile for exploitation probability.
Root Cause
The root cause is the server's acceptance and deserialization of attacker-controlled data without enforcing type binders, allow-lists, or integrity checks. When .NET deserializers such as BinaryFormatter, LosFormatter, or ObjectStateFormatter process crafted payloads, gadget chains resolve to methods that ultimately execute arbitrary commands.
Attack Vector
An unauthenticated remote attacker sends a specially crafted HTTP request containing a serialized payload to a vulnerable SharePoint endpoint. The server deserializes the payload during normal request handling, triggering execution of a chained gadget that runs attacker-supplied code as the SharePoint service identity. From that foothold, adversaries commonly extract machine keys, deploy web shells to layouts directories, and pivot into connected services and Active Directory.
No verified proof-of-concept code is published in the referenced advisories. Refer to the Microsoft CVE-2026-58644 Advisory for authoritative technical details.
Detection Methods for CVE-2026-58644
Indicators of Compromise
- Unexpected w3wp.exe child processes such as cmd.exe, powershell.exe, or csc.exe spawned from the SharePoint application pool.
- New .aspx files written to SharePoint layouts directories, particularly under C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\.
- Outbound network connections from SharePoint servers to unfamiliar IP addresses or command-and-control infrastructure.
- IIS log entries containing large __VIEWSTATE or serialized payloads targeting SharePoint endpoints such as ToolPane.aspx.
Detection Strategies
- Hunt for anomalous process lineage where IIS worker processes launch scripting or compilation utilities.
- Inspect IIS request logs for unauthenticated POST requests carrying oversized or base64-encoded serialized data to SharePoint pages.
- Monitor file integrity on SharePoint web directories to detect newly dropped handlers or web shells.
Monitoring Recommendations
- Forward SharePoint IIS logs, Windows Security events, and Sysmon telemetry to a centralized analytics platform for correlation.
- Alert on modifications to SharePoint machine keys and unexpected service account authentication activity across the domain.
- Track outbound egress from SharePoint tiers, which normally have limited internet exposure.
How to Mitigate CVE-2026-58644
Immediate Actions Required
- Apply the Microsoft security updates referenced in the Microsoft CVE-2026-58644 Advisory to all SharePoint Server 2016, 2019, and Subscription Edition farms.
- Rotate SharePoint machine keys after patching to invalidate any keys that may have been exfiltrated during exploitation.
- Review SharePoint servers for signs of prior compromise, including unauthorized web shells and new local or domain accounts.
Patch Information
Microsoft has released security updates addressing the deserialization flaw. Administrators should install the updates listed in the Microsoft Security Response Center advisory on all affected SharePoint Server versions. CISA's inclusion in the Known Exploited Vulnerabilities catalog makes remediation mandatory for federal civilian agencies within the KEV due date.
Workarounds
- Restrict network access to SharePoint servers so only trusted internal clients and reverse proxies can reach the web front ends.
- Enable and configure the Antimalware Scan Interface (AMSI) integration in SharePoint to inspect suspicious payloads at runtime.
- Isolate or take offline any SharePoint servers that cannot be immediately patched and are exposed to untrusted networks.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
