# CVE-2026-58644: SharePoint RCE Zero-Day Exploited in the Wild

> CISA adds CVE-2026-58644, a critical Microsoft SharePoint Server deserialization RCE vulnerability with a CVSS 9.8, to its Known Exploited Vulnerabilities catalog.

- Published: 2026-07-17T09:58:24.000Z
- Severity: critical
- Category: Vulnerabilities
- Tags: CVE-2026-58644, SharePoint, Microsoft, CISA KEV, RCE
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/07/cisa-adds-exploited-sharepoint-rce-zero.html
- Canonical: https://runtimerebel.com/blog/cve-2026-58644-sharepoint-rce-zero-day-exploited-in-the-wild

## Key points

- Threat actors are actively exploiting a critical vulnerability in Microsoft SharePoint Server to execute remote code with high privileges.
- Impacted systems include multiple versions of Microsoft SharePoint Server susceptible to unsafe deserialization of untrusted data.
- Organizations must apply the official Microsoft security updates immediately and prioritize patching before the July 19, 2026 deadline.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently updated its Known Exploited Vulnerabilities (KEV) catalog to include a [Zero-Day](/glossary#zero-day) vulnerability impacting Microsoft SharePoint Server. Identified as [CVE-2026-58644](/cve/cve-2026-58644), this flaw represents a critical security risk with a [CVSS](/glossary#cvss) score of 9.8. The [CVE](/glossary#cve) allows unauthenticated attackers to achieve [RCE](/glossary#rce) by exploiting a deserialization issue within the server's handling of untrusted data. According to [The Hacker News](https://thehackernews.com/2026/07/cisa-adds-exploited-sharepoint-rce-zero.html), Federal Civilian Executive Branch (FCEB) agencies are mandated to remediate this vulnerability by July 19, 2026.

## Technical Analysis of CVE-2026-58644

At its core, CVE-2026-58644 is a deserialization vulnerability. Deserialization occurs when an application takes structured data (like XML, JSON, or binary objects) and converts it back into an object in memory. If the application does not properly validate the incoming data stream before processing it, an attacker can craft a malicious payload that triggers the execution of arbitrary commands. Because SharePoint often runs with elevated service account permissions, successful exploitation typically grants the attacker significant control over the host environment.

This specific [TTP](/glossary#ttp) is highly effective because it bypasses many traditional perimeter defenses that focus on file-based malware. By sending a malicious serialized object over standard web protocols, an attacker can compromise the underlying server without requiring user interaction. This makes the vulnerability particularly dangerous for organizations that host SharePoint instances exposed to the public internet.

### Exploitation of SharePoint CVE-2026-58644 in the Wild

The addition of this flaw to the CISA KEV catalog confirms that active exploitation has been observed by security researchers or government agencies. Historically, SharePoint has been a high-value target for [APT](/glossary#apt) groups seeking to gain a foothold within corporate networks. Compromising a SharePoint server provides attackers with a central repository of sensitive documentation, as well as a strategic platform for [Lateral Movement](/glossary#lateral-movement) across the domain. Once an attacker achieves initial access, they often deploy a [C2](/glossary#c2) framework to maintain persistence and begin data exfiltration.

## Detection and Remediation Guidance

Security teams should prioritize the identification of exposed SharePoint instances. To effectively manage this risk, administrators must follow official Microsoft SharePoint Server RCE patch guidance, which involves applying the latest cumulative updates provided by the vendor. Beyond patching, defensive teams should focus on behavioral monitoring to identify post-exploitation activity.

### How to Detect CVE-2026-58644 Exploit

Organizations can improve their visibility by monitoring for unusual child processes spawned by the SharePoint worker process (w3wp.exe). Defenders should utilize their [SIEM](/glossary#siem) to alert on the execution of cmd.exe, powershell.exe, or any unexpected network connections originating from SharePoint servers. Furthermore, [SOC](/glossary#soc) analysts should review application logs for serialization-related errors or unexpected stack traces that deviate from baseline operations. Integrating these detections into an [EDR](/glossary#edr) platform ensures that any attempt to leverage this vulnerability is met with immediate isolation. Mapping these activities to the [MITRE ATT&CK](/glossary#mitre-att-ck) framework—specifically focusing on T1203 (Exploitation for Client Execution) and T1059 (Command and Scripting Interpreter)—can help contextualize the threat within a broader incident response plan.

**Related:** [CVE-2026-45659: SharePoint RCE via Deserialization - Patch Now](/blog/cve-2026-45659-sharepoint-rce-via-deserialization-patch-now), [Microsoft Patches Record 622 Flaws and Two Zero-Days — Patch Now](/blog/microsoft-patches-record-622-flaws-and-two-zero-days-patch-now)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/cve-2026-58644-sharepoint-rce-zero-day-exploited-in-the-wild