Active Exploitation Emergency: CISA Mandates Urgent Fix for SharePoint RCE Zero-Day CVE-2026-58644
Executive Summary
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency addition to its Known Exploited Vulnerabilities (KEV) Catalog, requiring all Federal Civilian Executive Branch (FCEB) agencies to rapidly patch a critical, actively exploited remote code execution (RCE) flaw in Microsoft SharePoint Server. Disclosed during the July 2026 Patch Tuesday updates and tracked as CVE-2026-58644, the vulnerability carries a near-maximum CVSS score of 9.8.
The security defect stems from an unsafe deserialization of untrusted data within SharePoint’s web services layer. In active network-based attacks observed in the wild, remote threat actors authenticated as standard Site Owners have weaponized this flaw to execute arbitrary code with elevated farm-administrator privileges directly on underlying SharePoint host servers, gaining full domain entry and bypassing traditional perimeter firewalls.
Deep-Dive Technical Analysis
Microsoft SharePoint Server is a central collaboration, document management, and web publishing platform widely deployed across global enterprises and government agencies. Because SharePoint servers manage sensitive internal document libraries and maintain high-privilege Active Directory service accounts, an RCE flaw on a SharePoint instance represents a catastrophic perimeter compromise.
A technical breakdown of the CVE-2026-58644 deserialization flaw reveals a severe input processing failure:
* Unsafe Deserialization in Web Services: The vulnerability resides within SharePoint’s internal web service endpoints that handle serialized .NET objects transmitted over HTTP POST requests.
* Exploiting the Low-Privilege Authenticated Session: An attacker first establishes a valid, low-privilege session on a target SharePoint site (requiring only standard Site Owner permissions, which can be acquired via spear-phishing or credential stuffing).
* Injecting Malicious Serialized Payloads: The attacker crafts a malicious HTTP POST request containing a manipulated, serialized .NET object (utilizing gadget chains designed to execute operating system commands during object reconstruction).
* Executing Farm-Administrator RCE: When the SharePoint web service processes the incoming request, it deserializes the untrusted payload without verifying its type safety or structure. This triggers arbitrary code execution directly within the context of the SharePoint application pool (w3wp.exe), granting the attacker elevated farm-administrator and local SYSTEM privileges on the host operating system.
* Lateral Network Compromise: Operating as a farm administrator, the attacker can extract hardcoded database connection strings, dump Active Directory domain credentials, deploy web shells inside IIS directories, and move laterally across internal corporate networks.
Microsoft warned that the attack complexity is low and exploitation can be executed remotely over the internet, prompting CISA to mandate emergency remediation by July 19, 2026, under Binding Operational Directive (BOD) 22-01.
Industry Impact and Recommendations
The rapid addition of CVE-2026-58644 to CISA’s KEV Catalog underscores that enterprise collaboration servers remain high-value targets for advanced ransomware groups and state-sponsored APTs. When a standard authenticated user can exploit deserialization to gain full farm-administrator control, immediate patch management is mandatory.
We recommend that all system administrators, corporate CISOs, and enterprise IT teams implement the following urgent mitigations:
1. Apply Microsoft July 2026 Cumulative Updates Immediately: Deploy the official Microsoft security updates addressing CVE-2026-58644 across all on-premises SharePoint Server installations (including SharePoint Server 2016, 2019, and Subscription Edition).
2. Enable Antimalware Scan Interface (AMSI) in Full Mode: Ensure that Microsoft's Antimalware Scan Interface (AMSI) integration is fully enabled on all SharePoint servers and configured to Request Body Scan Mode: Full. This allows AMSI to inspect incoming HTTP POST request bodies and intercept malicious deserialization payloads prior to processing.
3. Restrict SharePoint Administrative Access: Audit user roles across all SharePoint site collections. Enforce strict least-privilege access controls, revoking unneeded Site Owner permissions to minimize the attack surface.
4. Isolate SharePoint Web Servers in Micro-Segmented DMZs: Isolate internal SharePoint web front-end (WFE) servers behind secure web application firewalls (WAFs) configured with strict inspection rules for .NET deserialization signatures.
References:
* The Hacker News — CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV Catalog
* CISA — CISA Urges SharePoint Hardening After New Exploitations