CISA KEV Catalog Adds SharePoint RCE Flaw CVE-2026-58644

Originally published on CyberNetSec.

Executive Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a directive concerning a critical vulnerability in Microsoft SharePoint Server, CVE-2026-58644. This remote code execution (RCE) flaw, with a CVSS score of 9.8, was added to CISA's Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation in the wild. Microsoft confirmed the vulnerability was exploited as a zero-day before a patch was available. CISA has mandated that Federal Civilian Executive Branch (FCEB) agencies patch the flaw by July 19, 2026. The agency warns that this vulnerability is being chained with three others (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164) to achieve full system compromise.

Vulnerability Details

CVE-2026-58644 is a deserialization of untrusted data vulnerability in Microsoft SharePoint Server. An attacker who is authenticated to a target site as a Site Owner can exploit this flaw to execute arbitrary code on the server in the context of the SharePoint application pool identity. The attack complexity is low, making it a significant threat to unpatched on-premises servers.

Attackers are reportedly chaining this vulnerability with three others to escalate their attacks:

• CVE-2026-32201: A separate SharePoint flaw.
• CVE-2026-45659: Another vulnerability in the attack chain.
• CVE-2026-56164: A SharePoint Server spoofing vulnerability (CVSS 5.3) also added to the KEV catalog.

This combination allows attackers to bypass authentication, execute code, and establish persistent access, effectively taking full control of the server.

Affected Systems

The vulnerabilities impact all supported on-premises versions of SharePoint, including:

• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Enterprise Server 2016

Cloud-based SharePoint services (SharePoint Online) are not affected.

Exploitation Status

Both Microsoft and CISA have confirmed that CVE-2026-58644 was actively exploited as a zero-day before patches were released on July 14, 2026. Its inclusion in the KEV catalog signifies ongoing, widespread attacks by various threat actors. Organizations like the American Hospital Association are urging members to patch immediately due to the high risk.

Impact Assessment

Successful exploitation of these vulnerabilities can lead to a complete compromise of an on-premises SharePoint server. This provides an attacker with a powerful foothold within a corporate network, as SharePoint often stores sensitive business data and integrates deeply with other enterprise systems like Active Directory. From a compromised server, attackers can exfiltrate data, deploy ransomware, or pivot to other systems on the network. The impact is particularly severe for organizations that rely on SharePoint as a central collaboration and document management platform.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:
| Type | Value | Description |
|---|---|---|
| process_name | w3wp.exe | Suspicious child processes (e.g., cmd.exe, powershell.exe) spawning from the SharePoint worker process w3wp.exe can indicate code execution. |
| log_source | SharePoint ULS Logs | Search for errors or unexpected entries related to deserialization or page rendering. |
| url_pattern | Unusual POST requests to SharePoint application pages. | Attackers may send specially crafted payloads to vulnerable endpoints. Monitor web logs for requests with abnormal size or content. |
| file_path | C:\Program Files\Common Files\microsoft shared\Web Server Extensions\ | Monitor for the creation of unexpected files (e.g., .aspx, .php) in SharePoint web directories, which could indicate a web shell. |

Detection Methods

• D3FEND: Process Analysis (D3-PA): Use EDR solutions to monitor the w3wp.exe process for anomalous behavior, such as spawning command shells or making outbound network connections to unusual IP addresses.
• D3FEND: Network Traffic Analysis (D3-NTA): Analyze web server logs for suspicious requests to SharePoint endpoints. Look for patterns that deviate from baseline user activity, such as requests from unfamiliar user agents or IP ranges.
• Vulnerability Scanning: Regularly scan internal and external-facing SharePoint servers with a vulnerability scanner updated with signatures for these CVEs to identify unpatched systems.

Remediation Steps

1. Prioritize Patching: Immediately apply the July 2026 security updates from Microsoft to all on-premises SharePoint servers. This is the most critical step.
2. Hunt for Compromise: After patching, review logs and use the observables listed above to hunt for any signs of pre-existing compromise.
3. Harden SharePoint: Review and apply security best practices for SharePoint, including restricting Site Owner permissions to only trusted users and implementing the principle of least privilege.
4. Network Controls: Restrict access to SharePoint servers from the internet as much as possible. If external access is required, place it behind a Web Application Firewall (WAF) with updated rules.