July 18, 2026 · Alastor InfoSec Team
CVE-2026-58644: Microsoft SharePoint Unauthenticated RCE Zero-Day (CVSS 9.8) Actively Exploited — Patch by July 19
A critical zero-day in Microsoft SharePoint Server is being actively exploited in the wild — and the CISA-mandated patch deadline for federal agencies passed yesterday. CVE-2026-58644 carries a CVSS 3.1 score of 9.8 (Critical), affects every supported on-premises SharePoint Server version, and requires no authentication to trigger. If your organization runs SharePoint on-premises and has not patched, attackers may already be inside.
What Is CVE-2026-58644?
CVE-2026-58644 is a deserialization of untrusted data vulnerability in Microsoft SharePoint Server that allows an unauthenticated remote attacker to execute arbitrary code on the server over a network connection. Unlike its sibling flaw CVE-2026-45659 (CVSS 8.8, added to CISA KEV in July), which required the attacker to hold at least Site Member privileges, this zero-day has no authentication requirement. An attacker on the internet who can reach your SharePoint instance on port 443 has everything they need.
The flaw was exploited as a zero-day — meaning adversaries were already weaponising it before Microsoft released a fix. CISA added CVE-2026-58644 to its Known Exploited Vulnerabilities (KEV) catalog on July 16, 2026, with Federal Civilian Executive Branch (FCEB) agencies required to apply the patch by July 19, 2026.
Technical Details
CVE ID: CVE-2026-58644
CVSS 3.1 Score: 9.8 (Critical)
Attack Vector: Network
Authentication Required: None
Vulnerability Type: Deserialization of Untrusted Data
Impact: Remote Code Execution
The exploitation path follows a pattern CISA documented in its July 14 advisory on SharePoint hardening. Attackers are using the deserialization flaw to gain initial code execution on the IIS worker process, then stealing IIS machine keys from the host. With those keys in hand, they forge ViewState payloads to achieve persistent code execution, create scheduled tasks or web shells for long-term access, and move laterally through the network. In post-exploitation chains observed in the wild, threat actors subsequently deployed malware and conducted data exfiltration.
CISA's July 14 advisory — "CISA Urges SharePoint Hardening After New Exploitations" — explicitly called out the pattern of chaining multiple SharePoint vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644) to establish persistence and deploy payloads on unpatched servers. The scope of active exploitation is therefore broader than a single CVE.
Affected Versions
The vulnerability affects all supported on-premises editions of Microsoft SharePoint Server:
- SharePoint Server Subscription Edition
- SharePoint Server 2019
- SharePoint Enterprise Server 2016
SharePoint Online (Microsoft 365) is not affected. Organizations that have migrated their SharePoint workloads to the cloud are not exposed to this specific vulnerability — though they may be exposed to entirely different classes of risk in tenant misconfiguration.
SharePoint Server 2013 is out of extended support and will not receive a patch. Organizations still running 2013 should treat this as an emergency migration trigger.
What Attackers Are Doing
The exploitation pattern we are seeing documented goes beyond a simple web shell drop. Attackers first use the unauthenticated deserialization flaw to execute code as the application pool identity, typically running with Local Service or Network Service privileges. They then read IIS machine keys from the registry or applicationHost.config, use those keys to generate valid VIEWSTATE tokens containing arbitrary .NET object graphs, and replay those tokens to execute additional code without needing the original deserialization path again.
This two-stage approach is significant because the second stage — ViewState forgery — is extremely difficult to detect through web application firewall rules alone. Blocking the initial deserialization payload does not prevent an attacker who already stole machine keys from continuing to operate.
The downstream objectives vary. Financial sector targets have seen ransomware precursors. Government and critical infrastructure targets show signs of persistent access tools likely used for espionage.
Remediation Steps
Patch first. Microsoft shipped fixes in the July 2026 Patch Tuesday cycle. Apply the relevant cumulative update for your SharePoint version immediately — do not wait for a scheduled maintenance window.
Rotate IIS machine keys. If there is any possibility your server was accessible before patching, rotate the machine key values configured in IIS and in SharePoint's web.config files. Any keys that have existed on an internet-exposed server during the exploitation window should be considered compromised.
Audit IIS logs for anomalous POST requests. Look for POST requests to /_vti_bin/, /layouts/, and similar SharePoint endpoint paths originating from unexpected source IPs, especially those containing unusually large ViewState parameters or base64-encoded payloads in form data.
Restrict network access. SharePoint administration interfaces and server management ports should never be directly accessible from the internet. If your SharePoint server exposes port 443 to the open internet without a Web Application Firewall in front, reconsider your network architecture.
Check for persistence mechanisms. Review IIS scheduled tasks, application pool configurations, and the SharePoint hive for unexpected files. Look for web shells with .aspx or .ashx extensions in SharePoint's _layouts, _catalogs, or wpresources directories.
Enable SharePoint Unified Logging Service (ULS) logs and forward them to your SIEM. Post-exploitation activity generates distinctive log patterns that endpoint detection tools on the server may flag.
Context: SharePoint's Ongoing Exploitation Problem
CVE-2026-58644 is the fourth SharePoint vulnerability confirmed actively exploited this month. Alongside CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164, attackers appear to be systematically targeting organisations that run on-premises SharePoint and have historically been slow to apply Patch Tuesday updates. This is not coincidence — SharePoint's complexity means many organisations defer patching out of concern for breaking customisations, and threat actors have learned to time exploitation campaigns around that window.
For security teams, this serves as a reminder that SharePoint's on-premises deployment model carries a maintenance burden that cloud alternatives do not. If your business runs SharePoint on-premises primarily out of inertia rather than genuine technical or regulatory necessity, now is a reasonable time to revisit that decision.
How Alastor InfoSec Can Help
Alastor Pulse, our PTaaS dashboard, delivers first critical findings in under six hours. If you are unsure whether your SharePoint deployment is exposed, or whether you have already been compromised, our team can conduct an emergency assessment that covers the full SharePoint attack surface — including the IIS machine key theft path that patches alone do not remediate retroactively.
Reach us at [email protected] or visit our Alastor Pulse product page for details on how continuous penetration testing surfaces vulnerabilities like CVE-2026-58644 before attackers do.
CVE-2026-58644 is a CVSS 9.8 unauthenticated RCE zero-day in on-premises SharePoint Server added to CISA KEV on July 16, 2026 — the patch deadline has passed, making every unpatched instance an active liability.