Active Exploitation: CISA Adds Critical 9.8-Severity SharePoint RCE Zero-Day to KEV Catalog
Executive Summary
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive adding a newly patched, critical security flaw impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog. Formally announced on July 16/17, 2026, and reported by The Hacker News, the vulnerability—tracked as CVE-2026-58644—carries a near-maximum CVSS severity score of 9.8. The defect is a deserialization of untrusted data flaw that resides within SharePoint’s internal file-handling routines. In a network-based attack, an attacker authenticated with standard "Site Owner" privileges can exploit this vulnerability over an HTTP connection to execute arbitrary, untrusted code remotely on the host SharePoint Server. To protect federal networks from systemic intrusion, CISA has triggered mandatory remediation deadlines under Binding Operational Directive (BOD) 22-01, ordering federal agencies to apply Microsoft’s hotfix immediately.
Deep-Dive Technical Analysis
Enterprise Content Management and Collaboration platforms (such as Microsoft SharePoint) are vital hubs that aggregate, index, and distribute confidential business records, single sign-on (SSO) configurations, and critical database connectors across the enterprise intranet. Because these servers sit at the boundary between internal directories and external access points, and operate with high system-level database permissions, they represent high-value targets for advanced persistent threat (APT) groups seeking to establish persistent backdoors and exfiltrate entire corporate repositories.
A technical analysis of the CVE-2026-58644 deserialization vulnerability reveals a critical parsing failure:
* The Entry Vector (Site Owner Authentication): Unlike unauthenticated remote exploits, CVE-2026-58644 requires the attacker to be authenticated as at least a SharePoint Site Owner. While this normally represents a high-trust boundary, threat actors can easily acquire these credentials through spear-phishing campaigns, credential stuffing, or purchasing active session cookies from Initial Access Brokers (IABs) on underground forums.
* Exploiting the Deserialization Logical Flaw: The vulnerability resides within SharePoint's backend file-importing and data-parsing components. When a Site Owner uploads a custom file or submits serialized datasets to specific endpoints over an HTTP POST request, the server utilizes deserialization libraries to reconstruct the data.
* The Lack of Input Sanitization: Because the application fails to properly sanitize and validate the structure of the incoming serialized payload, the parser processes untrusted object streams. An attacker can construct a malformed serialized object containing embedded, malicious commands.
* Achieving Remote Code Execution (RCE): During the deserialization process, the SharePoint server instantiates the malicious object. This triggers an out-of-bounds execution logical error, allowing the attacker to inject and execute arbitrary commands directly within the server's high-privilege application pool (w3wp.exe). This grants the attacker full command-line control, enabling them to dump memory caches, exfiltrate Active Directory secrets, and move laterally across the corporate network.
The low attack complexity and high repeatability of the exploit chain explain why threat actors actively weaponized this flaw as a zero-day prior to the release of Microsoft's July 2026 cumulative security updates.
Industry Impact and Recommendations
The addition of the SharePoint CVE-2026-58644 zero-day to CISA's KEV catalog proves that authenticated boundaries must not be treated as absolute security gates. When standard administrative credentials can be exploited to achieve full-system RCE, organizations must implement a strict zero-trust model of continuous authentication and active endpoint monitoring.
We recommend that all system administrators, Windows engineers, and corporate SecOps leads implement the following immediate mitigations:
1. Apply Microsoft Security Patches Immediately: Adhere to CISA’s urgent directive without delay. Apply the relevant Microsoft July 2026 cumulative hotfixes (specifically KB5002891 or subsequent SharePoint update packages) across all active on-premises SharePoint Server environments.
2. Implement Phishing-Resistant MFA across Administrative Accounts: To prevent attackers from acquiring "Site Owner" credentials, secure all SharePoint administrative, developer, and tenant accounts behind mandatory, hardware-bound FIDO2 multi-factor authentication.
3. Enforce Antimalware Scan Interface (AMSI) Monitoring: Ensure that AMSI is fully enabled and integrated on all SharePoint servers. Configure AMSI to utilize "Full" Request Body Scan mode to scan and block malicious, serialized HTTP POST payloads before they can be processed by the deserialization parser.
4. Enforce Rigid Internal Micro-Segmentation: Isolate on-premises SharePoint servers from core corporate directory servers and sensitive databases. Enforce strict outbound firewall rules to prevent compromised SharePoint application pools from executing unauthorized external connections or moving laterally.
References
* The Hacker News — CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
* SC Magazine — Critical Oracle EBS bug added to CISA list of exploited vulnerabilities