Critical Remote Code Execution: CISA Adds 9.8-Severity SharePoint Zero-Day CVE-2026-58644 to KEV Catalog
Executive Summary
The Cybersecurity and Infrastructure Security Agency (CISA) has officially added a critical remote code execution (RCE) vulnerability affecting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) Catalog based on active exploitation. Disclosed in security advisories on July 16/17, 2026, the vulnerability—tracked as CVE-2026-58644—carries a near-maximum CVSS severity score of 9.8.
The flaw is a critical deserialization of untrusted data vulnerability. In a network-based attack, an unauthenticated remote attacker who can authenticate with minimal site-level privileges (as low as a Site Owner) can write arbitrary code, which the SharePoint Server deserializes and executes. Because the application fails to safely reconstruct the serialized data stream, the exploit bypasses standard isolation boundaries, enabling unauthenticated remote code execution (RCE) on the underlying SharePoint host. Under BOD 22-01, CISA has mandated that federal civilian agencies apply the July 2026 cumulative updates to remediate this high-severity entry vector.
Vulnerability Metric
Details
CVE Identifier
CVE-2026-58644
CVSS Score
9.8 (Critical)
Vulnerability Type
Deserialization of Untrusted Data
Affected Software
Microsoft SharePoint Server
Compliance Mandate
CISA BOD 22-01
Deep-Dive Technical Analysis
In enterprise collaboration ecosystems, Microsoft SharePoint Server serves as a centralized document repository, intranet hub, and workflow orchestrator. Because it integrates directly with active directory infrastructures and houses highly sensitive corporate documentation, a compromise at the SharePoint application level represents an immediate, high-severity entry vector. Threat actors can exploit a SharePoint breach to gain a persistent foothold, exfiltrate sensitive files, or move laterally across connected corporate networks.
A technical analysis of the CVE-2026-58644 vulnerability and its active exploitation vectors reveals a critical deserialization flaw:
1. The Core Defect (Deserialization of Untrusted Data): Deserialization is the process of taking a serialized data stream (such as a structured object transmitted over the network) and reconstructing it back into an active object in application memory. The security vulnerability resides within how SharePoint Server handles and parses serialized objects transmitted during workflow or site-management operations.
2. Exploiting Low-Level Site Owner Credentials: To execute the exploit, an attacker must possess minimal site-level permissions (such as a Site Owner). While this normally represents a low-privilege security boundary, threat actors can easily acquire these credentials through phishing campaigns, brute-force attacks, or credential-harvesting infostealers.
3. The Deserialization Bypass and RCE: The authenticated attacker transmits a specially crafted, malicious serialized data stream containing arbitrary code parameters to the SharePoint endpoint. Because the application fails to validate or sanitize the incoming object structure before reconstruction, the SharePoint engine deserializes the untrusted data. This triggers an out-of-bounds execution error, allowing the attacker's injected code to run with the high privileges of the underlying SharePoint service account.
4. Achieving Full Host Takeover: Once remote code execution is achieved, the attacker can write persistent backdoors (web shells) inside IIS directories, exfiltrate the complete SharePoint document library, harvest connected database credentials, and pivot laterally to compromise the broader corporate Active Directory forest.
Because the attack complexity is low and exploitation can be executed remotely over the network with minimal privileges, the vulnerability represents an immediate, severe threat to corporate perimeters.
Industry Impact and Recommendations
The addition of the critical SharePoint RCE zero-day to CISA’s KEV Catalog demonstrates that enterprise collaboration suites remain prime, high-value targets for sophisticated cyber actors. When a deserialization flaw can be exploited to achieve full host takeover, organizations must prioritize rapid patch management and strict input validation.
We recommend that all system administrators, Windows engineers, and SecOps teams implement the following immediate mitigations:
* Apply July 2026 Microsoft Updates Immediately: Comply with CISA’s KEV directive without delay. Test, validate, and deploy the July 2026 cumulative security updates addressing CVE-2026-58644 to close active exploitation pathways across all on-premises SharePoint Server deployments.
* Enforce Strict Principle of Least Privilege (PoLP): Review and audit all active SharePoint site-level permissions. Ensure that Site Owner and administrative privileges are heavily restricted, and that standard employee accounts do not possess unnecessary authorization to write or modify serialized workflows.
* Enforce Mandatory, Phishing-Resistant MFA: Secure all SharePoint and corporate single sign-on (SSO) portals behind mandatory, hardware-bound FIDO2 multi-factor authentication, ensuring that compromised user credentials cannot be weaponized to execute RCE exploits.
* Enable and Configure AMSI and Request Body Scanning: For all on-premises SharePoint Server deployments, verify that the Antimalware Scan Interface (AMSI) is actively running and fully integrated with your endpoint protection platform (EPP) to scan and block malicious HTTP POST requests and serialized payloads.
References:
* The Hacker News — CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
* SocRadar — July 2026 Patch Tuesday: 622 Vulnerabilities, 3 Zero-Days