Active Zero-Day Infiltration: CISA Adds Critical Microsoft SharePoint Server RCE Flaw to KEV Catalog
Executive Summary
The Cybersecurity and Infrastructure Security Agency (CISA) has officially added a critical remote code execution (RCE) vulnerability affecting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) Catalog. Tracked as CVE-2026-58644, the vulnerability was actively exploited in the wild as a zero-day before Microsoft was able to release a patch during its record-shattering July 2026 security updates. The flaw affects all supported on-premises versions of SharePoint Server, enabling remote, unauthenticated attackers to execute arbitrary code and completely compromise internal server infrastructures. Due to the high rate of active, automated exploitation campaigns targeting corporate intranet nodes, CISA has mandated that all federal civilian executive branch agencies apply Microsoft’s cumulative hotfixes immediately under BOD 22-01.
Deep-Dive Technical Analysis
Microsoft SharePoint Server is a foundational component of corporate intranet infrastructures, used by global enterprises and government agencies to manage shared documents, corporate databases, and collaborative workflows. Because SharePoint servers are often linked directly to sensitive Active Directory (AD) domains, a compromise at this level represents a high-severity entry vector that can be leveraged to move laterally and compromise the entire corporate subnet.
A technical analysis of the CVE-2026-58644 vulnerability and its zero-day exploitation mechanics reveals a critical input validation failure:
* The Entry Vector (Unauthenticated Web Requests): The vulnerability resides within SharePoint’s administrative web services handling serialized XML or JSON metadata.
* Exploiting the Lack of Input Validation: When a remote, unauthenticated user transmits a crafted network payload (such as a malicious HTTP POST request containing serialized object metadata), the SharePoint server attempts to process it without enforcing proper session verification or cryptographic signature checks.
* Triggering the Remote Code Execution: Due to a critical flaw in the deserialization engine, the server processes the untrusted input directly inside its memory space. This allows the attacker to inject and execute arbitrary system-level commands under the security context of the high-privilege SharePoint service account (Network Service or Local System).
* Bypassing Perimeters and Lateral Movement: Once arbitrary code execution is achieved, the threat actors typically:
* Write a persistent ASPX web shell into public-facing IIS web directories to establish a secure backdoor.
* Dump active LSASS memory or exfiltrate cached Active Directory domain credentials.
* Intercept and exfiltrate highly sensitive internal corporate documents and private administrative databases.
Because the exploit requires no privileges, zero user interaction, and possesses low attack complexity, automated botnets have been actively scanning corporate perimeters to systematically compromise unpatched SharePoint installations.
Industry Impact and Recommendations
The active, in-the-wild exploitation of the SharePoint RCE zero-day proves that corporate collaboration suites remain primary targets for sophisticated state-sponsored and cybercriminal threat groups. When an unpatched intranet node can be exploited remotely to execute arbitrary commands, organizations must treat patching as a mission-critical priority.
We recommend that all system administrators, network engineers, and corporate CISOs implement the following immediate mitigations:
1. Apply Microsoft's July 2026 Cumulative Patches Immediately: Comply with CISA’s KEV advisory without delay. Apply the relevant Microsoft SharePoint Server security hotfixes addressing CVE-2026-58644 across all on-premises servers.
2. Restrict Public-Facing SharePoint Access: Never expose raw SharePoint Server web consoles directly to the public internet. Restrict all administrative and corporate access behind secure, isolated Virtual Private Networks (VPNs) or Zero-Trust Network Access (ZTNA) gateways.
3. Enable and Configure AMSI Scanning: Ensure that the Antimalware Scan Interface (AMSI) integration is actively running on all SharePoint servers. Configure IIS to execute a Full Scan of request bodies to automatically detect and block malicious POST payloads.
4. Conduct Forensically Deep Threat Hunts: For any organization running on-premises SharePoint Server nodes, initiate an immediate forensic threat hunt. Audit all web access logs, IIS directories, and system process trees for unusual, unauthorized child processes spawned by w3wp.exe or suspicious web shell uploads inside IIS folders.
References
* CISA — Known Exploited Vulnerabilities Catalog
* The Hacker News — CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV Catalog