AI-Era Deserialization: CISA Adds Critical 9.8-Severity SharePoint Server RCE Zero-Day to KEV Catalog
Executive Summary
The Cybersecurity and Infrastructure Security Agency (CISA) has officially added a critical remote code execution (RCE) vulnerability in Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) Catalog. Disclosed on July 16/17, 2026, and reported by Swati Khandelwal at The Hacker News, the vulnerability—tracked as CVE-2026-58644—carries a near-maximum CVSS score of 9.8.
The flaw is an unauthenticated deserialization of untrusted data vulnerability within SharePoint Server's parameter processing. When SharePoint receives malformed, serialized object structures over the network, it fails to sanitize or restrict them, allowing remote, unauthenticated attackers to execute arbitrary commands inside the target server’s host context with high administrative privileges. CISA has mandated that all Federal Civilian Executive Branch (FCEB) agencies apply the cumulative patches immediately, setting a rapid compliance deadline of July 19, 2026—signaling extreme urgency and active, widespread exploitation in the wild.
Deep-Dive Technical Analysis
In the world of web application security, serialization is the process of converting complex data structures or object states into a format (such as a binary stream or JSON/XML string) that can be easily transmitted over a network or saved to storage. Deserialization is the reverse process, reconstructing the original active object from the incoming data stream. A deserialization vulnerability occurs when an application accepts a serialized stream from an untrusted source and attempts to reconstruct the object without verifying its integrity or limiting the classes it can instantiate.
A technical analysis of the CVE-2026-58644 SharePoint Server RCE vulnerability reveals a severe deserialization failure:
* The Entry Vector (Unauthenticated Web Requests): Microsoft SharePoint Server hosts multiple, public-facing API endpoints designed to coordinate document sharing, search indexing, and real-time collaborative updates. Many of these endpoints handle incoming serialized parameters to streamline communication between clients and the central database.
* Exploiting the Untrusted Deserialization Gate (CVE-2026-58644): The security defect exists within the parameter-processing libraries of SharePoint’s administrative and collaborative APIs. A remote, unauthenticated attacker can transmit a specially crafted, malicious HTTP POST request to a vulnerable SharePoint endpoint, containing a malformed serialized object payload.
* Achieving Unauthenticated Remote Code Execution (RCE): Because the SharePoint application does not restrict or validate the incoming object types before deserializing them, the server’s underlying runtime environment processes the malformed stream. The attacker can structure the serialized payload to instantiate highly dangerous, pre-existing classes (known as "gadget chains") that automatically execute arbitrary operating system commands with elevated system privileges during the deserialization phase.
This allows the unauthenticated attacker to achieve full, root-level remote code execution (RCE) on the host SharePoint server, bypass all perimeter authentication controls, deploy persistent web shells, and move laterally across corporate subnets.
Industry Impact and Recommendations
The rapid addition of the SharePoint Server zero-day to CISA’s KEV Catalog, accompanied by an extremely tight compliance deadline (July 19, 2026), indicates that advanced persistent threat (APT) groups and ransomware actors are actively and aggressively weaponizing this flaw to compromise enterprise backends globally.
We recommend that all system administrators, Windows engineers, and corporate SecOps teams implement the following immediate mitigations:
1. Apply Microsoft's Security Updates Immediately: Comply with CISA's mandatory directive without delay. Apply Microsoft's cumulative July 2026 security updates addressing CVE-2026-58644 to all on-premises and virtual SharePoint Server deployments before the July 19 deadline.
2. Enable and Configure AMSI Integration for SharePoint: Verify that the Antimalware Scan Interface (AMSI) is actively running and fully integrated with your SharePoint Server. Ensure that the Request Body Scan mode is set to Full to scan and block malicious HTTP POST payloads before execution.
3. Isolate and Segment SharePoint Environments: Place your primary on-premises SharePoint servers inside a highly isolated, micro-segmented DMZ (Demilitarized Zone). Enforce strict egress firewall rules to restrict the servers from communicating with unauthorized external IP addresses.
4. Conduct Thorough Threat Hunting and Log Audits: Audit all web server access logs, IIS directories, and network traffic records for unusual HTTP POST requests targeting SharePoint API endpoints. Scan for the presence of recently written, unrecognized .aspx files (potential web shells) within IIS directories.
References
* The Hacker News — CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
* Techmaniacs — Cybersecurity Daily Briefing: July 17, 2026