Microsoft SharePoint Zero-Day Exploited by Hackers Before Patch

Microsoft SharePoint Server is being exploited by hackers using a zero-day vulnerability, prompting CISA to add it to the Known Exploited Vulnerabilities catalog.

Understanding the Vulnerability

The vulnerability in question is CVE-2026-58644, a critical deserialization vulnerability that allows remote, authenticated attackers to execute arbitrary code on the server. This vulnerability is particularly concerning because it can be exploited before authentication, giving attackers significant control over the system.

Attack Vector

The attack vector involves the deserialization of untrusted data, which is a common technique used by attackers to gain unauthorized access to systems. In this case, the vulnerability allows attackers to execute arbitrary code on the server, which can lead to a range of malicious activities, including data theft, ransomware attacks, and lateral movement within the network.

According to SecurityWeek, the critical-severity security defect allows remote, authenticated attackers to execute arbitrary code on the server, highlighting the need for immediate patching.

Who Is Affected

Microsoft SharePoint Server users are affected by this vulnerability, particularly those who have not applied the latest patches. The vulnerability is also being exploited in conjunction with other vulnerabilities, including Fortinet FortiSandbox flaws, which have been added to the CISA KEV catalog.

What the Sceptics Say

Some sceptics may argue that the vulnerability is overhyped since a patch is already available. However, the fact that the vulnerability is being actively exploited by hackers before the patch was released highlights the need for immediate action to protect against this threat.

How to Defend

• Apply the latest Microsoft patches for SharePoint Server immediately.
• Monitor systems for indicators of compromise (IOCs) related to this vulnerability.
• Implement network segmentation to limit the spread of malware in case of a breach.
• Use threat detection tools to identify and block suspicious activity.

Key Takeaways

1. Security Teams: Prioritize patching of Microsoft SharePoint Server and monitor for IOCs.
2. CISOs: Ensure that all systems are up-to-date with the latest patches and consider implementing additional security measures, such as network segmentation.
3. Developers: Be aware of the deserialization vulnerability and ensure that all data is properly validated and sanitized before use.
4. End Users: Be cautious when interacting with SharePoint Server and report any suspicious activity to the security team.

Sources

• The Hacker News: CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
• BleepingComputer: CISA urges immediate action on actively exploited Fortinet flaws
• SecurityWeek: Fresh SharePoint Vulnerability Exploited Soon After Disclosure