SharePoint CVE-2026-58644: New RCE Exploited in Wild

On-premises Microsoft SharePoint administrators have a second fire to put out this month. On July 16, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-58644, a critical remote code execution flaw in SharePoint Server, to its Known Exploited Vulnerabilities (KEV) catalog after confirming the bug is being exploited in the wild. The vulnerability carries a CVSS score of 9.8 and was patched in Microsoft’s July 2026 Patch Tuesday release — but attackers moved on it soon after disclosure, and CISA set a federal remediation deadline of July 19, 2026 for civilian agencies to apply the fix.

This is a distinct flaw from the SharePoint bug that dominated headlines two weeks ago. The CVE-2026-45659 RCE, exploited by the group tracked as Storm-2603 and added to KEV in early July, is a separate vulnerability with its own patch. Organizations that already remediated that issue are not covered against CVE-2026-58644 and must apply the newer update as well.

What the vulnerability is

CVE-2026-58644 is a deserialization of untrusted data vulnerability, classified under CWE-502. In practice, that means a SharePoint Server can be tricked into reconstructing an object from attacker-supplied serialized data and, in doing so, executing code the attacker planted inside it. Unsafe deserialization has been one of the most durable and dangerous bug classes in enterprise Java and .NET software for a decade precisely because it turns a data-parsing routine into a code-execution primitive.

According to CISA’s advisory, the flaw allows an unauthorized attacker to execute arbitrary code on a vulnerable server. Microsoft’s own guidance describes a network-based attack path in which an actor sends maliciously crafted serialized data to the SharePoint endpoint; some reporting notes that certain exploitation vectors involve an attacker who already holds at least Site Owner privileges, which they can then escalate into full remote code execution on the underlying server. Either way, the outcome is the same and severe: code running with the privileges of the SharePoint service on an internet-adjacent application server.

Which systems are affected

The vulnerability affects supported on-premises SharePoint Server deployments, specifically:

• SharePoint Server Subscription Edition
• SharePoint Server 2019
• SharePoint Server 2016

The exposure here is the on-premises footprint — the servers that organizations run and patch themselves. Microsoft’s cloud-hosted SharePoint Online in Microsoft 365 is operated and updated by Microsoft. As with most SharePoint RCE incidents, the highest-risk configuration is a server whose web front end or Central Administration interface is reachable from the public internet.

How attackers are using it

Post-exploitation activity reported around this vulnerability class follows a now-familiar SharePoint playbook. After gaining code execution, attackers have been observed stealing IIS machine keys — the cryptographic material SharePoint uses to sign and validate __VIEWSTATE and other payloads. Those keys are the crown jewels of a SharePoint compromise: with them, an attacker can forge valid serialized payloads at will and regain access even after the initial hole is patched, because the trust anchor itself has been stolen.

From there, the typical chain is to drop web shells for persistence, harvest credentials, and stage follow-on malware or lateral movement across the internal network. That is why CISA’s remediation guidance goes beyond “apply the patch”: a server that was exposed and unpatched should be treated as potentially compromised, with machine keys rotated and logs reviewed for signs of deserialization exploitation and unauthorized file writes.

What to do now

CISA’s recommended mitigations are concrete and worth following even outside the federal deadline:

• Apply the July 2026 Patch Tuesday updates for your SharePoint Server version immediately. This is the primary fix.
• Rotate IIS machine keys after patching, especially on any server that was internet-facing, and restart the affected services so new keys take effect.
• Do not expose SharePoint to the internet unless there is a business requirement to do so, and block external access to SharePoint Central Administration entirely.
• Restrict farm and database communications to the specific systems that require them, limiting an attacker’s ability to move laterally after a foothold.
• Hunt for prior compromise: review web directories for unexpected .aspx files, inspect logs for anomalous serialized requests, and validate that machine keys have not already been exfiltrated.

The pattern of “patch, then rotate keys” is central here. Because a stolen signing key survives a patch, organizations that treat this as a simple update — without assuming a breach on exposed servers — risk leaving a persistent backdoor open. A zero-trust posture that limits what a compromised SharePoint host can reach reduces the blast radius when a bug like this is weaponized before defenders can react.

For context on the broader update cycle this fix arrived in, see our rundown of the record July 2026 Patch Tuesday. And because deserialization is only one of several server-side flaw classes that turn a trusted application into an attacker’s foothold, the fundamentals of server-side request forgery are worth understanding alongside it.

What it means

Two actively exploited SharePoint RCEs in the same month is not a coincidence — it is a signal about where attackers are concentrating. On-premises SharePoint is a high-value target: it sits inside corporate networks, holds sensitive documents, runs with meaningful privileges, and is often internet-exposed for remote collaboration. Each new deserialization bug in it is a reliable path from the public internet to the intranet, and threat actors have shown they can operationalize these flaws within days of a patch dropping.

Who is most at risk. Organizations running on-premises SharePoint 2016, 2019, or Subscription Edition with any internet exposure — and especially those that were slow to patch CVE-2026-45659 and may already be dealing with stolen machine keys. Government agencies, given the federal deadline, and large enterprises with legacy SharePoint farms are squarely in the crosshairs.

What to watch next. Expect the exploitation window to widen as proof-of-concept code circulates and the flaw is folded into commodity attack tooling. Watch for public reporting attributing this campaign to named threat groups, for any indication that the unauthenticated attack path is being used at scale, and for the inevitable follow-on: incidents at organizations that patched but never rotated their keys. The lesson from every SharePoint deserialization incident this year is the same — patching is necessary, but on an exposed server it is not sufficient. Assume compromise, rotate the secrets, and shrink the attack surface before the next CVE lands.