CVE-2026-58644: Microsoft SharePoint — Unauthenticated Deserialization RCE

Background

Microsoft SharePoint Server is an enterprise collaboration and content management platform used by organisations worldwide for document storage, intranet portals, HR workflows, and team collaboration. On-premises SharePoint deployments are common across enterprise, government, education, and healthcare sectors. SharePoint Server integrates deeply with Active Directory — the application pool identity running SharePoint typically operates as a domain service account, giving a compromised SharePoint instance broad lateral movement capability within the domain.

CVE-2026-58644 is a critical unauthenticated remote code execution vulnerability caused by insecure deserialization of untrusted data (CWE-502) in Microsoft SharePoint Server. An attacker with network access to a SharePoint server can send a specially crafted request that triggers deserialization of attacker-controlled content, achieving code execution under the SharePoint application pool identity. CISA added it to the Known Exploited Vulnerabilities catalogue on 16 July 2026 with a three-day remediation deadline of 19 July 2026, reflecting active exploitation.

Technical Mechanism

Deserialization vulnerabilities in .NET applications occur when object graphs are reconstructed from attacker-supplied byte streams using unsafe formatters. When a .NET application deserializes untrusted data with formatters such as BinaryFormatter, NetDataContractSerializer, or similar mechanisms, an attacker can craft a payload that invokes arbitrary code through .NET’s object construction process. Known gadget chains in commonly loaded .NET assemblies enable code execution without requiring a custom payload.

SharePoint has a documented history of deserialization vulnerabilities following this pattern:

• CVE-2019-0604 exploited deserialization in SharePoint’s SOAP web services to achieve pre-authentication RCE and was widely exploited by APT groups
• CVE-2024-38094 exploited SharePoint deserialization handling and was used by ransomware operators within weeks of disclosure to establish persistent access in enterprise SharePoint farms

CVE-2026-58644 follows the same class. Microsoft’s advisory describes the attack as code execution over a network by an unauthorised attacker, confirming the pre-authentication nature of the flaw. Based on the CWE-502 classification and Microsoft’s description, the vulnerable code path processes incoming HTTP or SOAP requests and deserializes attacker-supplied content without first authenticating the request.

CVSS 3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): network-accessible, low attack complexity, no privileges required, no user interaction, complete compromise of confidentiality, integrity, and availability.

Real-World Exploitation Evidence

CISA’s 16 July 2026 KEV addition with a 19 July 2026 deadline — three days later, significantly shorter than the standard 21-day window — indicates active exploitation confirmed or assessed by CISA as imminent based on threat intelligence.

No specific threat actor or campaign has been publicly attributed at time of writing. SharePoint deserialization vulnerabilities have historically attracted:

• Initial access brokers selling network footholds into enterprise environments via SharePoint as an internet-exposed service
• Ransomware operators using SharePoint as a lateral movement pivot into Active Directory after initial domain access
• Nation-state actors — APT groups associated with China, Iran, and Russia have exploited prior SharePoint CVEs including CVE-2019-0604 and CVE-2024-38094 in targeted campaigns against government agencies and defence contractors

CVE-2024-38094 was exploited to achieve persistent access to SharePoint farms used by government agencies, with attackers leveraging the SharePoint application pool identity to pivot into Active Directory and establish domain persistence. A similar operational pattern is expected for CVE-2026-58644.

Shodan and Censys scanning data consistently shows tens of thousands of on-premises SharePoint instances directly exposed to the internet, primarily in education, government, and manufacturing sectors, representing the most immediately exposed population.

Impact Assessment

Successful exploitation provides code execution under the SharePoint application pool identity, which in most enterprise deployments is a domain service account. The consequences reach beyond the SharePoint server itself:

Active Directory access: The SharePoint service account typically has broad read access across AD, with permissions to query users, groups, and computer objects. In some deployments, this identity has write access to site collections, list permissions, and SharePoint-managed content.

Domain lateral movement: From the SharePoint application pool context, attackers can use the service account’s domain credentials for authenticated access to other systems trusting the same domain, pass-the-hash pivoting, or Kerberos ticket-based lateral movement.

Internal document access: SharePoint hosts internal documents, collaboration content, HR records, and often configuration files or stored credentials. A compromised SharePoint instance gives access to all content accessible to the service account.

Internet-exposed attack surface: Organisations with SharePoint web front-ends directly accessible from the internet are exposed to exploitation from any internet-connected attacker, without requiring prior network access.

Affected Versions

On-premises SharePoint Server deployments are affected. SharePoint Online (Microsoft 365) is not affected — Microsoft patches cloud-hosted instances directly. Exact version boundaries are documented in the Microsoft Security Response Center advisory for CVE-2026-58644.

Remediation Steps

1. Apply the Microsoft security update for CVE-2026-58644 immediately. Available via Windows Update, Microsoft Update Catalog, and Windows Server Update Services (WSUS). Federal agencies must meet the BOD 26-04 deadline of 19 July 2026.

2. Restrict network access to SharePoint web front ends from untrusted networks. SharePoint servers should not be directly internet-accessible without a Web Application Firewall or reverse proxy in front.

3. Review SharePoint application pool identity privileges. Ensure the application pool identity operates under a least-privilege service account, not domain administrator credentials. Reduce the AD permissions of the service account to the minimum required for SharePoint functionality.

4. Audit SharePoint ULS and IIS logs for anomalous POST requests to SharePoint service endpoints, particularly from untrusted source IP ranges and without valid authentication tokens.

5. Preserve logs before patching if exploitation is suspected. ULS logs (%CommonProgramFiles%\Microsoft Shared\Web Server Extensions\16\LOGS\), IIS logs, and Windows Event Logs are needed for forensic reconstruction. Patching may alter system state relevant to investigation.

No workaround removes the deserialization attack surface while maintaining SharePoint functionality. The patch is the required remediation.

Detection Guidance

Network-level: Anomalous POST requests to SharePoint SOAP endpoints (/_vti_bin/, /_api/, /_layouts/) from untrusted source IP ranges, especially without a valid Authorization header. HTTP 500 responses to POST requests targeting SharePoint service endpoints indicate failed exploitation attempts. HTTP 200 responses to the same patterns warrant investigation.

Process execution: Unusual child processes spawned from w3wp.exe (the IIS worker process hosting SharePoint) — particularly cmd.exe, powershell.exe, or wscript.exe. SharePoint application pools should not spawn shell processes under normal operation.

SharePoint ULS logs: Look for deserialization exceptions, unexpected process execution events, or requests to endpoints that should not accept untrusted data.

Windows Event Logs: Event ID 4688 (Process Creation) filtered for w3wp.exe parent processes spawning unexpected children. Event ID 4624/4625 for authentication events from unexpected source IPs against the SharePoint service account.

Persistence indicators: Modifications to SharePoint web application files, IIS application pool configuration changes, or new scheduled tasks created under the service account context.

Timeline

References

• Microsoft Security Response Center — CVE-2026-58644
• CISA Known Exploited Vulnerabilities Catalog
• NVD — CVE-2026-58644
• Microsoft Update Catalog
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk