Microsoft SharePoint deserialization of untrusted data (unauth RCE)
A critical unauthenticated deserialization RCE in on-prem Microsoft Office SharePoint (CVE-2026-58644, CVSS 9.8). Patched July 14 in Microsoft's July 2026 updates; added to CISA KEV on July 16.
- Vendor
- Microsoft
- Product
- SharePoint Server 2016 / 2019 / Subscription Edition
- CVSS
- 9.8
- EPSS (exploit probability)
- 15.9%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-58644 being exploited?
Yes. CISA added CVE-2026-58644 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 15.9% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-58644 is a CWE-502 deserialization-of-untrusted-data vulnerability in on-premises Microsoft Office SharePoint that lets an unauthenticated attacker execute code over a network. CVSS 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Microsoft published the fix on 2026-07-14 in its July 2026 security updates; CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-07-16, starting a federal-civilian remediation clock under BOD 26-04.
Affected builds
Per NVD — patched versions, apply at or above:
- SharePoint Server Subscription Edition (x64) — 16.0.19725.20384
- SharePoint Server 2019 (x64) — 16.0.10417.20153
- SharePoint Enterprise Server 2016 (x64) — 16.0.5556.1005
Anything below those build numbers is exposed. Microsoft’s authoritative reference is the MSRC advisory for CVE-2026-58644.
What to do
Apply the July 2026 SharePoint update if you haven’t already; the fix has been out for two days. If your farm is Internet-exposed and was unpatched between July 14 and now, treat it as possible-compromise rather than routine patching — the same IIS machineKey theft and web-shell drop patterns CISA called out on the three earlier SharePoint KEV entries this week apply to this class of bug too. Roll the machine keys, review sign-in logs, and look for web shells in the SharePoint LAYOUTS directory before calling the incident closed.
Other Microsoft SharePoint CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerabilitywrite-up | [ HIGH ] | 8.8 | 2.1% | |
| CVE-2026-55040 SharePoint Server JWT token authentication bypasswrite-up | [ CRITICAL ] | 9.1 | 69.5% | |
| CVE-2026-50522 SharePoint Server deserialization of untrusted data RCEwrite-up | [ CRITICAL ] | 9.8 | 3.0% | |
| CVE-2026-56164 SharePoint Server elevation of privilege — missing authentication for critical functionwrite-up | [ MEDIUM ] | 5.3 | 1.0% | |
| CVE-2026-45659 Microsoft SharePoint Server deserialization remote code executionransomware usewrite-up | [ HIGH ] | 8.8 | 2.7% | |
| CVE-2026-32201 SharePoint Server spoofing via improper input validationwrite-up | [ MEDIUM ] | 6.5 | 43.4% | |
| CVE-2026-20963 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 29.2% | |
| CVE-2025-49706 Microsoft SharePoint Improper Authentication Vulnerabilityransomware use | [ MEDIUM ] | 6.5 | 99.1% |
