Microsoft SharePoint Vulnerability CVE-2026-58644 Under Active Exploitation

CISA has added CVE-2026-58644 to its Known Exploited Vulnerabilities catalog, requiring Federal Civilian Executive Branch agencies to apply the fixes by July 19, 2026, due to its active exploitation in the wild.

Understanding the Vulnerability

The vulnerability in question, CVE-2026-58644, is a critical deserialization of untrusted data vulnerability in Microsoft SharePoint Server. This allows remote, authenticated attackers to execute arbitrary code on the server, leveraging MITRE ATT&CK techniques such as Exploitation for Privilege Escalation and Remote Services. Similar past incidents, like the Apache Log4j vulnerability, highlight the importance of promptly addressing deserialization vulnerabilities.

Vulnerability Mechanics

The deserialization vulnerability exists because the SharePoint server does not properly validate user input, allowing an attacker to craft malicious requests that can execute arbitrary code. This vulnerability can be exploited by attackers to gain control over the server, potentially leading to data breaches, malware distribution, or other malicious activities.

Who Is Affected

Organizations using Microsoft SharePoint Server are at risk, particularly those in sectors that rely heavily on SharePoint for collaboration and document management. While the vulnerability affects various versions of SharePoint, applying the latest patches provided by Microsoft is crucial for mitigation.

What the Sceptics Say

Some sceptics might argue that since a patch is already available, the situation is under control, and the addition of CVE-2026-58644 to the KEV catalog might be an overreaction. However, given the 9.8 CVSS score and the fact that it is being actively exploited, prompt action is necessary to prevent widespread exploitation.

How to Defend

• Apply the latest security patches from Microsoft for SharePoint Server immediately.
• Implement network segmentation to limit the spread of an attack.
• Monitor for unusual activity, focusing on Remote Procedure Call (RPC) and other potential attack vectors.
• Consider enhanced monitoring for SharePoint servers, given the current threat landscape.

Key Takeaways

1. Security Teams: Prioritize patching CVE-2026-58644 and monitor SharePoint servers closely for signs of exploitation.
2. CISOs: Ensure that all SharePoint servers are updated with the latest security patches and review incident response plans.
3. Developers: Focus on secure coding practices, especially concerning deserialization and input validation, to prevent similar vulnerabilities in the future.
4. End Users: Be cautious of phishing attempts that might be related to this vulnerability and report any suspicious activity to the IT department.

Sources

• The Hacker News: CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
• BleepingComputer: CISA urges immediate action on actively exploited Fortinet flaws
• SecurityWeek: Fresh SharePoint Vulnerability Exploited Soon After Disclosure
• Infosecurity Magazine: CISA Mandates Urgent Patch for Actively Exploited Critical Fortinet Vulnerabilities
• Security Affairs: U.S. CISA adds Fortinet FortiSandbox and Microsoft SharePoint flaws to its Known Exploited Vulnerabilities catalog