Microsoft SharePoint Zero-Day RCE Vulnerability CVE-2026-58644 Exploited

CISA has added the Microsoft SharePoint deserialization of untrusted data vulnerability (CVE-2026-58644) to its Known Exploited Vulnerabilities catalog, with a CVSS score of 9.8, requiring immediate patching by Federal Civilian Executive Branch agencies.

Understanding the Vulnerability

The vulnerability in question is a critical deserialization of untrusted data flaw that allows remote, authenticated attackers to execute arbitrary code on the server. This is a significant concern as it could be leveraged by attackers to gain control over vulnerable systems, potentially leading to further malicious activities such as data theft, ransomware deployment, or the establishment of a persistent threat presence within the compromised network.

Attack Vector

The vulnerability can be exploited through remote access to the SharePoint server, highlighting the importance of securing access points and ensuring that all users, especially those with elevated privileges, are subject to strict authentication and authorization controls.

Who Is Affected

The vulnerability affects Microsoft SharePoint Server, specifically versions that have not been updated with the latest security patches. Given the widespread use of SharePoint in various sectors for collaboration and document management, the potential impact is significant, affecting not just government agencies but also private sector organizations.

What the Sceptics Say

Some might argue that since a patch is already available, the immediate risk is mitigated for those who keep their systems up to date. However, the rapid exploitation of this vulnerability after its disclosure underscores the importance of swift action, as even a short window of exposure can be enough for attackers to gain a foothold.

How to Defend

• Apply the latest security patches for Microsoft SharePoint Server as soon as possible to prevent exploitation of the vulnerability.
• Implement robust access controls, including multi-factor authentication, to reduce the risk of unauthorized access to the SharePoint server.
• Monitor network traffic and system logs for signs of potential exploitation or malicious activity, such as unusual access patterns or unexpected changes in system behavior.

Key Takeaways

1. Security Teams: Prioritize the patching of Microsoft SharePoint Server and monitor for signs of exploitation.
2. CISOs: Ensure that all necessary patches are applied across the organization and review access controls and monitoring capabilities.
3. Developers: Be aware of secure coding practices, especially regarding deserialization of data, to prevent similar vulnerabilities in future applications.
4. End Users: Be cautious of phishing attempts or other social engineering tactics that might be used in conjunction with this vulnerability.

Sources

• The Hacker News: CISA Adds Exploited SharePoint RCE Zero-Day to KEV
• BleepingComputer: CISA urges immediate action on actively exploited Fortinet flaws
• SecurityWeek: Fresh SharePoint Vulnerability Exploited Soon After Disclosure
• Infosecurity Magazine: CISA Mandates Urgent Patch for Actively Exploited Critical Fortinet Vulnerabilities
• Security Affairs: U.S. CISA adds Fortinet FortiSandbox and Microsoft SharePoint flaws to its Known Exploited Vulnerabilities catalog