CVE-2026-58644 — Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

1. Executive summary

CVE-2026-58644 is a critical (CVSS 9.8) deserialization of untrusted data vulnerability in Microsoft SharePoint Server, enabling an unauthenticated, remote attacker to execute arbitrary code over a network with no user interaction. The flaw stems from insecure deserialization (CWE-502) and carries a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a full system compromise impact. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on 2026-07-16, confirming active exploitation in the wild. EMEA financial services running on-premise SharePoint Server must treat this as an immediate, severe risk to their operational continuity and data confidentiality.

2. Regulatory framing

3. Technical analysis & attack chain

Affected Products (per NVD CPE configuration)

• Microsoft SharePoint Server 2019
• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server Subscription Edition (versions up to, but excluding, 16.0.19725.20434)

Vulnerability Mechanism

The vulnerability (CWE-502) exists within Microsoft Office SharePoint's data handling processes. The application fails to properly validate or restrict objects during the deserialization of untrusted data. Because the attacker requires no privileges (PR:N) and no user interaction (UI:N), a specially crafted serialized payload delivered to a vulnerable SharePoint endpoint can force the application to instantiate malicious objects, leading directly to remote code execution in the context of the SharePoint application pool or service account.

Attack Chain

1. Initial Access & Execution: An unauthenticated attacker sends a maliciously crafted serialized data payload to a vulnerable Microsoft SharePoint Server over the network (Port 443/80, typically HTTP/HTTPS).
2. Bypass & Exploitation: The SharePoint service deserializes the payload without proper validation. The malicious object is instantiated, executing arbitrary code within the application's context.
3. Impact: Successful exploitation results in full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), allowing the attacker to pivot, exfiltrate data, or deploy secondary payloads.

Note: The CISA KEV entry notes "Known ransomware campaign use: Unknown." While a related SharePoint deserialization vulnerability (CVE-2026-45659) was previously reported as patched by Microsoft, this specific CVE (CVE-2026-58644) represents a distinct, more critical flaw due to the lack of required authentication. No specific threat actor attribution is available in the provided source data.

4. Mitigation & containment

P1 — Within 24 hours (Containment & Remediation)

• Patch Immediately: Apply the vendor security update for Microsoft SharePoint Server. For SharePoint Server Subscription Edition, ensure the build is updated to at least 16.0.19725.20434.
• Internet Exposure Reduction: If patching cannot be completed immediately, isolate all SharePoint Server instances from the public internet. Restrict access to internal VPN or trusted IP ranges only via firewall/WAF rules.
• Discontinue Use (Fallback): If mitigations are unavailable and the system cannot be patched or isolated, temporarily decommission the SharePoint server to prevent active exploitation.

P2 — Within 72 hours (Validation)

• Forensic Triage: Conduct forensic triage on all SharePoint servers to identify potential historical exploitation. Look for unexpected application pool worker process (w3wp.exe) spawns, anomalous child processes, or unauthorized file modifications in web directories.
• Authentication Hardening: Ensure IIS authentication settings are strictly enforced, though this vulnerability bypasses authentication entirely.

P3 — Within 7 days (Long-term)

• Architecture Review: Evaluate the necessity of running legacy on-premise SharePoint instances. Transition to managed cloud alternatives (e.g., SharePoint Online) where deserialization boundaries are maintained by the vendor.

5. Indicators of compromise

No indicators of compromise available in the source material.

6. Detection

Insufficient indicators to author detection rules.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• NVD, CVE-2026-58644 Detail, https://nvd.nist.gov/vuln/detail/CVE-2026-58644, 2026-07-15
• CISA, Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644, 2026-07-16

8. Adverse Trace position

CVE-2026-58644 represents a maximum-severity risk to EMEA financial services operating on-premise Microsoft SharePoint infrastructure. The combination of network-based exploitation, no required authentication, and confirmed active exploitation in the wild (CISA KEV) creates an immediate pathway for data breach and operational disruption. Clients must prioritize patching to build 16.0.19725.20434 or higher for Subscription Edition, and equivalent patches for 2019/2016 servers, within the next 24 hours. Adverse Trace will continue to monitor for specific threat actor attribution and IOCs related to this exploitation and will update clients as corroborated intelligence emerges.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.