CVE-2026-58644

Microsoft SharePoint Remote Code Execution Vulnerability

Exploited in the wild. In CISA KEV since 2026‑07‑16. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile97th16% chance in 30 days CISA KEVListedsince 2026-07-16, due 2026-07-19
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-14Updated 2026-07-17Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your Microsoft SharePoint is one of these affected versions: SharePoint Enterprise Server 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition.
Identify your current SharePoint build/version number from your server’s SharePoint “About”/version page.
Compare your build to the fixed builds, and upgrade to at least one of these fixed versions: 16.0.5556.1005 (Enterprise Server 2016), 16.0.10417.20153 (Server 2019), or 16.0.19725.20384 (Subscription Edition).
If you cannot update immediately, restrict network access to the SharePoint server (especially from the internet) and ensure only required internal networks/users can reach it until the update is applied.
After updating, re-check the SharePoint build/version to confirm it matches or is newer than the fixed version you installed.

Vendor advisory Usually a quick update

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

In plain language

Written by AI from the record

CVE-2026-58644 is a SharePoint flaw that lets an attacker run malicious code on your server over the network without any login—if you use affected SharePoint versions, you should treat it as urgent to update.

CVE-2026-58644 is an unauthenticated remote code execution in Microsoft SharePoint caused by unsafe deserialization of attacker-controlled network input, allowing arbitrary code execution on the SharePoint server.

If you're affected

Complete server compromise
Business data exposure
Site disruption or outage
Malware/ransomware foothold

What is it

This is a weakness in Microsoft SharePoint where it can be tricked into treating attacker-sent data as “instructions.”
If someone can reach your SharePoint server, they may be able to make it run code of their choosing, which can lead to a full takeover of the server. Think of it like a door lock that can be forced with a specially crafted key sent through the network.

Who is affected

This matters if your business runs Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition.
The risk is remote: no login and no user action are required for the attack attempt, and an attacker would only need network reachability to your SharePoint server.
Because “reachable in default config” is not confirmed in the provided findings, you should assume risk anywhere the attacker can send requests to your SharePoint server (for example, via internet exposure or other network paths).

How urgent is it

This is RED because it enables remote code execution without authentication, which means an attacker who can reach your server can potentially take over the system.
While the provided information does not show confirmed exploitation in the press or public exploit code, the fix is available and the impact is high (server compromise, disruption, and data exposure).

What to do — in detail

Confirm exposure (what to check)
- Determine which Microsoft SharePoint product you run: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition.
- On each SharePoint server (if you have multiple), record the exact SharePoint build/version.
- If the build is older than the fixed build for your edition, you should consider the server exposed to this vulnerability.
Upgrade to the fixed version (target versions)
- SharePoint Enterprise Server 2016: upgrade to fixed in 16.0.5556.1005.
- SharePoint Server 2019: upgrade to fixed in 16.0.10417.20153.
- SharePoint Server Subscription Edition: upgrade to fixed in 16.0.19725.20384.
- Use the official Microsoft guidance page for CVE-2026-58644: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644
Validate the upgrade
- After installing updates, check that the SharePoint build/version now matches or is newer than the fixed version for your edition.
- If you have a farm/load-balanced setup, ensure all nodes are updated (not just the one you checked).
If patching is delayed (temporary containment)
- Reduce network reachability to SharePoint:
  - Ensure the SharePoint server is not directly exposed to the internet unless absolutely required.
  - Restrict inbound access to only the IP ranges/hosts that must reach it.
  - Confirm your reverse proxy/firewall rules only allow necessary endpoints and networks.
- Watch for unexpected inbound requests to SharePoint-related endpoints and review SharePoint/server logs for anomalies during the delay window.
What to monitor after update
- Confirm no further update-related errors are present.
- Review server/application logs for unusual activity around SharePoint.

CISA KEV due date: Not available here (CVE-2026-58644 is not listed in the provided KEV data).

Technical context

CVE-2026-58644 is a critical remote code execution (CWE-502) in Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition.
Mechanism: attackers can send specially crafted network input that SharePoint processes through unsafe deserialization, which can allow arbitrary code execution on the server. The findings state authentication is not required and there is no user interaction required.
Exploitation status: KEV is not listed in the provided data, and no dated real-world exploitation claim or public exploit code is noted in the findings. However, the overall verdict is RED due to the severity and the availability of fixed builds.
Attack vector: Network reachability to the vulnerable SharePoint service is the key requirement; exploit reliability can depend on your exposure, but the vulnerability itself does not require a login or user action per the findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS97th

CISA KEV

Listed as exploited in the wild since 2026-07-16.

US federal agencies must remediate by 2026-07-19.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

16% chance of exploitation activity in the next 30 days, which ranks it in the 97th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising.

Lifecycle

22 events over 91 days, from the signal feeds we watch.

2026-09-24EPSS band changehigh → moderateepss band change
2026-09-21EPSS band changemoderate → highepss band change
2026-08-17EPSS band changelow → moderate
2026-08-15EPSS band changelow → moderateepss band change
2026-08-14Nuclei check added
2026-07-18Analysis publishedSharePoint's next 9.8: an unauthenticated RCE that was exploited before the patch shipped (CVE-2026-58644)

Affected products

Microsoftcommercial · US
- Microsoft SharePoint Enterprise Server 2016Web AppOn-premEnterprise Software / itsm-monitoring
- Microsoft SharePoint Server 2019Web AppOn-premEnterprise Software / itsm-monitoring
- Microsoft SharePoint Server Subscription EditionWeb AppOn-premEnterprise Software / collaboration-groupware
- sharepoint serverWeb AppOn-premEnterprise Software / collaboration-groupware

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable