Critical Infrastructure Alert: CISA Adds Actively Exploited SharePoint RCE (CVE-2026-58644) to KEV
Executive Summary
In mid-July 2026, the Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent directive updating its Known Exploited Vulnerabilities (KEV) Catalog to include CVE-2026-58644, a critical remote code execution (RCE) vulnerability in Microsoft SharePoint Server carrying a near-maximum CVSS score of 9.8. Originally addressed during Microsoft's July Patch Tuesday updates, subsequent threat intelligence confirmed active zero-day and post-disclosure exploitation in the wild. The flaw allows authenticated attackers—requiring as little as Site Owner permissions—to execute arbitrary commands on host SharePoint servers over local networks or the public internet. CISA has mandated that all Federal Civilian Executive Branch (FCEB) agencies apply vendor patches immediately.
Deep-Dive Technical Analysis
CVE-2026-58644 is a severe deserialization of untrusted data vulnerability present within Microsoft SharePoint Server's web service endpoints and object-management libraries:
* Deserialization Mechanics: When a user with Site Owner privileges interacts with custom web parts or site-configuration management APIs, SharePoint processes serialized .NET objects containing state data. Unvalidated object instantiation allows an attacker to supply a crafted, malicious binary stream containing gadget chains (e.g., standard .NET deserialization payload chains like TypeConfuseDelegate or PSObject).
* Arbitrary Code Execution Path: As the IIS worker process (w3wp.exe) deserializes the untrusted stream, the payload triggers arbitrary command execution directly on the underlying Windows operating system with the privileges of the SharePoint service account (frequently NT AUTHORITY\NETWORK SERVICE or elevated domain service accounts).
* Low Attack Complexity & Chain Potential: Although exploitation requires an initial authenticated account with Site Owner rights, attackers frequently combine this flaw with stolen credentials, stolen session cookies, or lower-severity authentication bypasses (such as CVE-2026-56164) to achieve unauthenticated zero-click server takeover. Once code execution is achieved, threat actors drop persistent web shells (.aspx) inside IIS virtual directories to pivot across internal domain controllers.
Industry Impact and Recommendations / Mitigations
On-premises Microsoft SharePoint deployments remain central collaboration hubs for government bodies, defense contractors, healthcare networks, and global enterprises:
* Mandatory Emergency Patching: Organizations running on-premises SharePoint Server 2016, 2019, or Subscription Edition must apply the Microsoft July 2026 security updates immediately.
* Audit SharePoint Site Permissions: Enforce strict access control over Site Owner and administrative role assignments across all SharePoint farms to reduce the exposure surface for authenticated deserialization attacks.
* IIS Process Isolation & EDR Monitoring: Configure IIS application pools to execute under dedicated, low-privilege service accounts rather than domain admin accounts. Enable Endpoint Detection and Response (EDR) agent monitoring on SharePoint web servers to detect spawned child processes (such as cmd.exe or powershell.exe originating from w3wp.exe) and anomalous .aspx file creation in web directories.
References
* CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
* CISA Urges SharePoint Hardening After New Exploitations
* Fresh SharePoint Vulnerability Exploited Soon After Disclosure