CVE-2026-58644: Microsoft SharePoint Server Unauthenticated Remote Code Execution Vulnerability Exploited in the Wild

1. Executive summary

Microsoft disclosed CVE-2026-58644 on July 14, 2026, a critical (CVSS 9.8) unauthenticated remote code execution (RCE) vulnerability affecting on-premises Microsoft SharePoint Server deployments. The vulnerability stems from the deserialization of untrusted data (CWE-502) and permits an unauthenticated, remote attacker to execute arbitrary code. Microsoft confirmed active exploitation in the wild, and CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on July 16, 2026. EMEA financial services organizations running on-premises SharePoint Server 2016, 2019, or Subscription Edition face an immediate risk of system compromise and must treat patching as an emergency operational resilience priority.

2. Regulatory framing

3. Technical analysis & attack chain

1. Initial Access & Exploitation: An unauthenticated, remote attacker sends a maliciously crafted request to an exposed on-premises Microsoft SharePoint Server.
2. Vulnerability Mechanism: The target server fails to properly validate input, leading to the deserialization of untrusted data (CWE-502). This allows the attacker's payload to be processed and executed by the server application.
3. Execution: The deserialization flaw permits the attacker to execute arbitrary code in the context of the SharePoint application, leading to full system compromise.
4. Observed Exploitation: Microsoft and CISA have confirmed active exploitation in the wild. Specific detection signatures indicate attackers are manipulating request bodies and headers to trigger the vulnerability.

Affected Products

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server Subscription Edition

Detection Signatures

Microsoft reports observed exploitation attempts trigger the following AMSI / Microsoft Defender detections:

• Exploit:Script/SuspSignoutReqBody.A (Request body scanning; applies to SharePoint Server Subscription Edition; Microsoft reports observed exploitation attempts are blocked by this signature).
• Exploit:Script/ToolPaneAuthBypass.A (Request header scanning; applies to SharePoint Server 2016, SharePoint Server 2019, and Subscription Edition).
• Exploit:Script/ToolPaneAuthBypass

Confidence caveat: At the time of publication, no public IP addresses, domains, URLs, or additional network-based indicators of compromise have been widely disclosed. Threat actor attribution has not been established in the provided source material.

4. Mitigation & containment

P1 — Within 24 hours: Patch and Verify

• Apply the July 14, 2026 security updates for all affected SharePoint versions (2016, 2019, Subscription Edition) across all servers in the farm.
• Verify that the security updates completed successfully across all SharePoint servers.
• If immediate patching is not possible, temporarily restrict external access to SharePoint web applications (e.g., via VPN or IP allowlisting on the reverse proxy/WAF) to reduce the attack surface.

P2 — Within 24 hours: Enable and Monitor Detections

• Ensure Antimalware Scan Interface (AMSI) integration is enabled for every SharePoint web application.
• Monitor Microsoft Defender and AMSI detections for indicators of attempted exploitation, specifically alerting on:
• Exploit:Script/SuspSignoutReqBody.A
• Exploit:Script/ToolPaneAuthBypass.A
• Exploit:Script/ToolPaneAuthBypass

P3 — Within 72 hours: Incident Response & Exposure Assessment

• Initiate incident response procedures if exploitation artifacts or the above detections are triggered.
• Conduct an authenticated vulnerability scan using tools like InsightVM or Nexpose (checks available since the July 14 content release) to ensure comprehensive coverage and verify remediation.

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, URLs) are available in the source material.

Behavioural indicators

6. Detection

Insufficient indicators to author YARA or Sigma rules. The source material provides Microsoft Defender/AMSI signature names (behavioural detections) but no file artifacts, command-line strings, or registry keys suitable for rule authorship. Clients should rely on the native Microsoft Defender and AMSI signatures listed in §5.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• Rapid7, "CVE-2026-58644: Microsoft SharePoint Server Unauthenticated Remote Code Execution Vulnerability Exploited in the Wild", https://www.rapid7.com/blog/post/etr-cve-2026-58644-microsoft-sharepoint-server-unauthenticated-remote-code-execution-vulnerability-exploited-in-the-wild, 2026-07-17
• CISA / NVD, "CVE-2026-58644 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability", https://nvd.nist.gov/vuln/detail/CVE-2026-58644, Accessed 2026-07-17

8. Adverse Trace position

CVE-2026-58644 represents a critical (CVSS 9.8) threat to EMEA financial services organizations operating on-premises Microsoft SharePoint Server. The unauthenticated nature of the exploit, combined with confirmed in-the-wild exploitation and CISA KEV listing, necessitates immediate emergency patching. Adverse Trace assesses the risk of system compromise as severe for unpatched, internet-facing deployments. We are advising all clients to prioritize the July 14, 2026 security updates, enforce AMSI integration, and monitor for the specified Defender signatures. We will continue to monitor for the disclosure of atomic IOCs and threat actor attribution.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.