Critical Deserialization: CISA Adds 9.8-Severity SharePoint RCE Zero-Day to KEV Catalog
Executive Summary
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added a newly patched, critical vulnerability in Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) Catalog based on active exploitation in the wild. Tracked as CVE-2026-58644 and carrying a near-maximum CVSS score of 9.8, the flaw represents a critical deserialization of untrusted data vulnerability. Remote, authorized attackers with at least Site Owner privileges can exploit this vulnerability over a network to execute arbitrary, malicious code directly on the hosting SharePoint Server.
Because the attack complexity is extremely low and allows repeatable success without prior system knowledge, threat actors have been actively weaponizing it to compromise backend enterprise document pools and execute RCE, prompting CISA to mandate a rapid federal remediation deadline of July 19, 2026.
Deep-Dive Technical Analysis
Microsoft SharePoint Server is a widely deployed, enterprise-grade collaboration and document management platform that aggregates critical corporate data, including business-critical documentation, financial reports, and intellectual property. Because it sits at the intersection of internal user workflows and external contractor access, and frequently links directly to corporate single sign-on (SSO) databases, a compromise at the SharePoint server level represents an immediate, high-severity threat to the enterprise backend.
A technical analysis of the CVE-2026-58644 deserialization vulnerability and its RCE exploit vector reveals a critical validation failure:
1. The Vulnerable Endpoint (Deserialization of Untrusted Data): The security defect exists within how SharePoint processes structured, incoming XML or serial data packages submitted by authenticated users. Specifically, when a Site Owner or higher privilege user uploads configuration metadata or executes administrative APIs, the server attempts to parse and deserialize the input.
2. Exploiting the Lack of Input Validation: Deserialization is the process of converting a serial stream of bytes back into an active software object in memory. Because SharePoint fails to properly restrict and validate the input before deserializing, an attacker can transmit a specially crafted, malicious byte stream containing embedded, executable commands (often utilizing .NET or XML external data input flaws).
3. Triggering the RCE: When parsed by the server's vulnerable deserialization libraries, the malformed payload executes. Because the service runs with high system privileges, the injected code is launched directly within the application's context on the target server.
4. The Low Attack Complexity: Unlike many other RCE exploits that require deep, prior knowledge of the target environment's architecture or memory layouts, CVE-2026-58644 allows for repeatable, reliable success. Once an attacker obtains the baseline credentials of a Site Owner (often achieved via phishing or credential stuffing), they can execute the exploit reliably over the internet to compromise the entire hosting server.
Because the vulnerability allows authenticated Site Owners to achieve unauthenticated-level remote code execution on the underlying server operating system, it has been rapidly integrated into the active threat landscape.
Industry Impact and Recommendations
The addition of the SharePoint RCE zero-day to CISA's KEV Catalog demonstrates that moderate-level authentication boundaries (such as Site Owner privileges) do not protect against critical infrastructure compromises if input validation controls are absent. Once attackers gain entry-level privileges, they can leverage deserialization flaws to execute full server takeovers.
We recommend that all system administrators, Windows engineers, and enterprise SecOps teams implement the following immediate mitigations:
* Apply the July 2026 Security Patches Immediately: Prioritize the immediate testing and deployment of updates addressing CVE-2026-58644 across all on-premises SharePoint Server deployments (including SharePoint Server 2016, 2019, and Subscription Edition).
* Verify and Enable Full AMSI Integration: Configure the Windows Antimalware Scan Interface (AMSI) on the SharePoint server and set the Request Body Scan mode to Full to scan and block malicious HTTP POST requests before they can trigger the deserialization process.
* Enforce Rigid Role-Based Access Control (RBAC): Audit all active SharePoint accounts and strictly limit the number of users granted "Site Owner" or higher administrative privileges. Implement the principle of least privilege, ensuring that users are only granted the minimal access required to perform their tasks.
* Monitor for Anomalous Process Spawns on SharePoint Hosts: Configure SIEM logging to monitor the behavior of the IIS worker process (w3wp.exe) on SharePoint servers. Set up real-time alerts to instantly flag and block any attempt by the worker process to spawn unexpected administrative shells (such as cmd.exe or powershell.exe).
References
* The Hacker News — CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
* SocRadar — July 2026 Patch Tuesday: 622 Vulnerabilities, 3 Zero-Days