CVE-2026-58644

This is a weakness in Microsoft SharePoint where it can be tricked into treating attacker-sent data as “instructions.”
If someone can reach your SharePoint server, they may be able to make it run code of their choosing, which can lead to a full takeover of the server. Think of it like a door lock that can be forced with a specially crafted key sent through the network.

This matters if your business runs Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition.
The risk is remote: no login and no user action are required for the attack attempt, and an attacker would only need network reachability to your SharePoint server.
Because “reachable in default config” is not confirmed in the provided findings, you should assume risk anywhere the attacker can send requests to your SharePoint server (for example, via internet exposure or other network paths).

This is RED because it enables remote code execution without authentication, which means an attacker who can reach your server can potentially take over the system.
While the provided information does not show confirmed exploitation in the press or public exploit code, the fix is available and the impact is high (server compromise, disruption, and data exposure).