CISA Adds SharePoint RCE CVE-2026-58644 to KEV Catalog

Originally published on CyberNetSec.

Executive Summary

On July 16, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-58644, a critical vulnerability in Microsoft SharePoint Server, to its Known Exploited Vulnerabilities (KEV) catalog. This action confirms the vulnerability has been actively exploited in the wild as a zero-day. The flaw is a deserialization of untrusted data with a CVSS score of 9.8, enabling an authenticated attacker to achieve remote code execution (RCE). Microsoft SharePoint Server is a common target for threat actors, and this flaw provides a direct path to server compromise. CISA has mandated that Federal Civilian Executive Branch (FCEB) agencies apply the patch by July 19, 2026. All organizations are strongly advised to prioritize patching and investigate for potential compromise.

Vulnerability Details

• CVE ID: CVE-2026-58644
• Severity: Critical
• CVSS Score: 9.8
• Vulnerability Type: Deserialization of Untrusted Data
• Attack Vector: Network
• Prerequisites: Attacker must be authenticated with "Site Owner" privileges.

The vulnerability allows an attacker who has already gained Site Owner-level privileges on a SharePoint site to inject and execute arbitrary code on the underlying server. While the attack requires prior authentication, the privileges needed are commonly held by departmental administrators or power users, not just server administrators. This makes the attack feasible once an initial foothold is gained through other means like phishing. The attack complexity is low.

Affected Systems

The vulnerability affects the following on-premises Microsoft SharePoint Server versions:

• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Enterprise Server 2016

SharePoint Online is not affected.

Exploitation Status

Microsoft confirmed that CVE-2026-58644 was exploited as a zero-day before the patch was released on July 14, 2026. CISA's addition to the KEV catalog on July 16 reinforces the urgency. Threat actors are known to chain SharePoint vulnerabilities for post-exploitation activities. CISA noted that this flaw, along with others like CVE-2026-56164, is being used to steal IIS machine keys for further access and to deploy malware for persistence, such as web shells. This indicates that the exploit is being used by sophisticated actors for sustained access.

Impact Assessment

Successful exploitation of CVE-2026-58644 leads to full remote code execution on the SharePoint server, with severe potential impacts:

• Server Compromise: Attackers gain control of the server, allowing them to install malware, including ransomware or backdoors like T1505.003 - Web Shell.
• Data Exfiltration: Access to all data stored on the SharePoint server, including sensitive corporate documents, intellectual property, and personal information.
• Lateral Movement: The compromised SharePoint server can be used as a pivot point to move laterally within the corporate network, escalating the breach.
• Persistence: Attackers can establish long-term persistence by stealing IIS machine keys or deploying other malware, making remediation difficult.

---

IOCs — Directly from Articles

No specific file hashes, domains, or IP addresses were provided in the source articles for use as IOCs.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

Type	Value	Description	Context
process_name	w3wp.exe	The IIS worker process that runs SharePoint. Monitor for this process spawning command shells (cmd.exe, powershell.exe) or making unusual network connections.	EDR, Host-based logs
file_path	C:\inetpub\wwwroot\wss\VirtualDirectories\	Default path for SharePoint web applications. Monitor for newly created or modified .aspx, .ashx, or .asmx files, which could be web shells.	File Integrity Monitoring (FIM)
event_id	4688	Windows Security Event ID for process creation. Enable command-line logging and audit for suspicious commands executed by the SharePoint application pool identity.	Windows Event Logs, SIEM
log_source	SharePoint ULS Logs	SharePoint's Unified Logging Service logs may contain errors or anomalies related to deserialization failures during an exploitation attempt.	Application server log analysis

Detection & Response

1. Hunt for Web Shells: Proactively scan SharePoint server web directories for suspicious .aspx or other web-executable files. Use D3-FA: File Analysis to check for common web shell signatures and characteristics.
2. Process Monitoring: Implement EDR rules to detect when the w3wp.exe process initiates suspicious child processes like powershell.exe, cmd.exe, whoami.exe, or net.exe. This is a strong indicator of RCE.
3. Enable AMSI: As recommended by CISA, ensure the Antimalware Scan Interface (AMSI) integration for SharePoint is enabled. This allows endpoint security products to inspect scripts and commands executed by SharePoint for malicious content.
4. Review Site Owner Permissions: Audit all users and groups with "Site Owner" privileges. Scrutinize these accounts for any signs of compromise and reduce the number of accounts with this permission level to the absolute minimum required.

Mitigation

1. Apply Security Updates: The primary mitigation is to immediately apply the July 2026 security updates for the respective SharePoint Server versions. This is a direct implementation of D3-SU: Software Update.
2. Harden SharePoint: Follow CISA's guidance on SharePoint hardening. This includes disabling unused services, applying the principle of least privilege for service accounts, and restricting administrative access.
3. Network Segmentation: Isolate SharePoint servers from the general user network. Restrict outbound internet access from the servers to prevent easy data exfiltration or C2 communication. This aligns with D3-NI: Network Isolation.
4. Regular Audits: Implement regular, automated audits of SharePoint permissions and configurations to detect unauthorized changes or privilege escalation.