# Microsoft SharePoint RCE Zero-Day Now Weaponized: CISA Orders Immediate Federal Patch


## The Threat


A critical remote code execution vulnerability in Microsoft SharePoint Server has moved from theoretical risk to active exploitation in the wild, prompting the U.S. Cybersecurity and Infrastructure Security Agency to add CVE-2026-58644 to its Known Exploited Vulnerabilities (KEV) catalog on Thursday. The flaw, rooted in unsafe deserialization of untrusted data, allows unauthenticated attackers to execute arbitrary code on vulnerable SharePoint servers without requiring user interaction or administrative privileges.


Deserialization vulnerabilities represent one of the most dangerous attack surfaces in enterprise software. When applications automatically convert serialized data—often transmitted across networks or stored in files—back into executable objects without proper validation, attackers can craft malicious payloads that execute code during the conversion process. In SharePoint's case, this flaw bypasses authentication entirely, making it trivial to weaponize at scale.


The vulnerability affects SharePoint Server deployments across federal, commercial, and critical infrastructure organizations worldwide. Given SharePoint's ubiquitous presence in enterprise environments as the primary document management and collaboration platform for thousands of organizations, the blast radius is substantial. CISA's emergency directive requires all Federal Civilian Executive Branch agencies to patch by July 19, 2026—a compressed three-day window that underscores the agency's assessment of immediate, unacceptable risk.


## Severity and Impact


| Attribute | Details |

|---|---|

| CVE ID | CVE-2026-58644 |

| CVSS v3.1 Score | 9.8 (Critical) |

| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |

| Attack Vector | Network |

| Attack Complexity | Low |

| Privileges Required | None |

| User Interaction | None |

| Scope | Unchanged |

| Confidentiality Impact | High |

| Integrity Impact | High |

| Availability Impact | High |

| Weakness | CWE-502: Deserialization of Untrusted Data |

| Exploitation Status | Active exploitation confirmed |


## Affected Products


Microsoft SharePoint Server:

  • SharePoint Server 2019
  • SharePoint Server 2016
  • SharePoint Server 2013
  • SharePoint Foundation 2013

    • Note: SharePoint Online and cloud-based deployments are not affected, as Microsoft has implemented mitigations at the service level. Only on-premises installations require immediate patching.


    ## Mitigations


    ### Immediate Actions (Priority 1)


    1. Apply Security Updates: Microsoft released patches on the second Tuesday of the month. Deploy the latest cumulative update (CU) or security update for your SharePoint version immediately. Federal agencies must complete this by July 19, 2026.


    2. Monitor Authentication Logs: Enable and review SharePoint ULS (Unified Logging Service) logs for anomalous deserialization events, particularly targeting the SharePoint Web Services infrastructure.


    3. Network Segmentation: Restrict network access to SharePoint servers. Limit inbound connections to known trusted client ranges and administrative networks. Place SharePoint servers behind Web Application Firewalls (WAFs) configured to inspect serialized object payloads.


    ### Interim Workarounds (if patching is delayed)


  • Implement reverse proxy authentication requiring multi-factor authentication (MFA) before traffic reaches SharePoint
  • Disable public internet access to SharePoint and enforce VPN requirements
  • Run intrusion detection signatures to block known exploitation patterns targeting CVE-2026-58644

    • ### Long-Term Recommendations


  • Audit all SharePoint custom solutions and third-party add-ins for unsafe deserialization patterns
  • Implement application allowlisting at the process level to restrict code execution within SharePoint worker processes
  • Plan migration to SharePoint Online or modern alternatives to reduce the surface area of legacy on-premises infrastructure

    • ## References


  • CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • CISA Alert AA26-198-001 (CVE-2026-58644 Emergency Directive): https://www.cisa.gov/news-events/alerts
  • Microsoft Security Update Guide: https://msrc.microsoft.com/update-guide/
  • Microsoft SharePoint Security Advisory: https://support.microsoft.com/en-us/office/sharepoint-server-security-updates

    • ---


    ## HackWire Analysis


    The weaponization of CVE-2026-58644 represents a textbook escalation from disclosure to real-world exploitation in record time. That CISA is imposing a three-day patch deadline—far shorter than the typical 30-60 day windows even for critical flaws—signals that exploitation attempts are not hypothetical warnings but confirmed, active threats detected in federal networks.


    What distinguishes this incident is the *accessibility* of the attack surface. Deserialization vulnerabilities don't require sophisticated reconnaissance or social engineering; they're triggered by merely sending a network packet. No user interaction, no authentication, no complex preconditions. For threat actors operating at scale, this means low-cost, high-probability compromise of any unpatched SharePoint server reachable from the internet or internal networks. Organizations running internet-facing SharePoint portals for document sharing or citizen services are sitting ducks.


    The federal mandate also reveals something critical: the government has likely observed this vulnerability being exploited against government systems already. CISA doesn't impose emergency three-day patches for theoretical risks. Someone has already compromised federal SharePoint instances, and the agency is now racing to contain spread across the civilian executive branch.


    For defenders, the hard truth is that many organizations will miss the July 19 deadline. SharePoint patches often require coordination with change management windows, load-balanced infrastructure updates, and regression testing—luxuries unavailable in a 72-hour sprint. Organizations unable to patch should immediately implement the network segmentation and reverse proxy MFA controls outlined above. SharePoint is rarely a public-facing necessity; treat it as internal-only infrastructure. If it isn't, ask why, and fix that architectural decision before the patch window closes.


    — *HackWire Editorial*


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)