SharePoint's next 9.8: an unauthenticated RCE that was exploited before the patch shipped (CVE-2026-58644)

Microsoft's July 2026 Patch Tuesday was its largest ever, and buried in it was a SharePoint bug that ticks every box you don't want ticked at once: unauthenticated, remote, code execution, and already being used in real attacks. By the numbers it is a 9.8. In practice the number almost undersells it - because the exploit was demonstrated at Pwn2Own before Microsoft ever shipped a patch, and because this class of SharePoint bug has a persistence trick that survives the patch you're about to install.

What the flaw actually is

The weakness is deserialization of untrusted data (CWE-502). Microsoft's own description is blunt: "Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network." In plain terms, attacker-controlled bytes reach a .NET deserializer, and a crafted serialized object graph turns into code running inside the SharePoint IIS worker process. Affected products are the on-prem editions - SharePoint Enterprise Server 2016, SharePoint Server 2019, and Subscription Edition. SharePoint Online in Microsoft 365 is not affected.

One honest caveat: four days after disclosure, Microsoft has not published the exact vulnerable endpoint, and no public technical write-up describes the specific sink. What is well documented is the lineage. The 2025 SharePoint "ToolShell" wave abused the same __VIEWSTATE / machine-key deserialization surface - stealing ASP.NET keys and forging signed payloads that deserialize into code. Because the new bug is the same product family and the same bug class, that mechanism is the plausible route. Whether it is a direct variant of the 2025 chain is unconfirmed, so treat the ToolShell mechanics below as the attributed pattern, not a proven description of this specific flaw.

Why a bug no one has PoC'd is still an emergency

You may notice the EPSS score is low - around 0.015, roughly the 70th percentile - and wonder how a 9.8 with a low EPSS can be urgent. The answer is that EPSS and KEV measure different things. EPSS is a statistical model driven by observable signals: public exploit code, scanner chatter, mass-scanning telemetry. For a brand-new bug with no public PoC, those inputs are mostly absent, so the score stays low and will jump the moment code appears. KEV, by contrast, is CISA saying it has confirmed evidence of exploitation in the wild. When the two disagree, KEV wins.

And the "no public PoC" reassurance is thin here. A functional exploit demonstrably exists: this bug and its twin CVE-2026-50522 are a matching pair of CVSS 9.8 SharePoint deserialization bugs shown at Pwn2Own Berlin, where ZDI handed Microsoft working code. ZDI publicly criticised Microsoft's "Exploit Maturity: Unknown" label for exactly that reason. The exploit is real; it just isn't on GitHub yet.

The exploitation chain

Here is the path from an exposed farm to persistent code execution, with the points where a defender can break the chain. The attacker's route runs down the middle; the green branches on the right are your chokepoints. Note the last one - rotating machine keys - because it is the step that actually evicts an intruder the patch leaves behind.

Am I affected?

Read your farm build with (Get-SPFarm).BuildVersion and compare it to the fixed build for your edition. The build numbers below are confirmed against NVD; the KB article strings reported in secondary coverage (KB5002653/54/55) could not be confirmed on a primary Microsoft page, so verify those against the MSRC Security Update Guide before you cite them in a change ticket. After installing binaries, run PSConfig - a farm can report the new build while the fix isn't actually wired in.

Exploited before the patch - and part of a bigger wave

This bug didn't arrive alone. It sits inside a July 2026 on-prem SharePoint cluster that CISA flagged together (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164 and this one), and it shares a bloodline with the 2025 ToolShell mass exploitation. VulnCheck characterised current activity as targeted rather than a broad campaign - but with a public exploit's plumbing already proven, that can change quickly. Shadowserver tracks roughly 10,000 internet-exposed on-prem SharePoint servers overall, which is the pool at risk across the whole cluster.

Detection & hunting

There are no bug-specific indicators to key on yet, so hunt on behaviour, not on 2025's filenames and IP addresses (those are almost certainly stale for a new campaign). The 2025 ToolShell detection corpus - SigmaHQ rules for CVE-2025-53770 and the Neo23x0 YARA set - transfers well at the behavioural level; just broaden the campaign-specific literals before you deploy it.

• SharePoint worker spawning a shell - w3wp.exe launching cmd.exe, powershell.exe, or csc.exe. The app pool almost never does this legitimately; it's your highest-fidelity signal.
• New .aspx in the LAYOUTS directory - anything written under ...\Microsoft Shared\Web Server Extensions\1[56]\TEMPLATE\LAYOUTS\.
• Machine-key theft - PowerShell under w3wp.exe reading ValidationKey/DecryptionKey from web.config; Defender/AMSI hits like Trojan:PowerShell/MachineKeyFinder.DA!amsi.
• Adapt, don't copy the 2025 rules (SigmaHQ CVE-2025-53770, Neo23x0 signature-base) - keep the behaviour, relax the filenames/hashes.

What to do now

1. Patch every farm to the July-2026 fixed build for its edition, then run PSConfig.
2. Enable AMSI Full Mode (Request Body Scan = Full) and confirm Defender/EDR is running on every SharePoint server.
3. If it was internet-facing since ~July 14, assume compromise - hunt and remove web shells / machine-key harvesters (and any malicious applicationHost.config/web.config module entries) first.
4. Rotate ASP.NET machine keys on all farm servers (Update-SPMachineKey; confirm the exact cmdlet for your build), then iisreset so the new keys load.
5. Patch the rest of the July-2026 SharePoint cluster in the same window - CVE-2026-32201, CVE-2026-45659, CVE-2026-56164 and the twin CVE-2026-50522.
6. Verify estate-wide, and fold in an EoL migration plan for anything you can't keep patched.

FAQ

Sources

• NVD - CVE-2026-58644
• Microsoft MSRC advisory
• CISA Known Exploited Vulnerabilities catalog
• Zero Day Initiative - The July 2026 Security Update Review
• The Hacker News - CISA adds exploited SharePoint RCE zero-day
• SecurityWeek - Fresh SharePoint vulnerability exploited soon after disclosure
• Cybersecurity Dive - CISA warns of multiple exploited SharePoint flaws
• Microsoft - Disrupting active exploitation of on-premises SharePoint (2025 lineage + guidance)
• SigmaHQ - CVE-2025-53770 detection rules