CVE-2026-58644
Microsoft SharePoint Remote Code Execution Vulnerability
Exploited in the wild. In CISA KEV since 2026‑07‑16. Fixed versions are out.
What to do
Find your product and version, then upgrade to the build on the right.
- Microsoft SharePoint Enterprise Server 2016Affected: ≥ 16.0.0, < 16.0.5556.1005Upgrade to: 16.0.5556.1005Stated by: CVE record
- Microsoft SharePoint Server 2019Affected: ≥ 16.0.0, < 16.0.10417.20153Upgrade to: 16.0.10417.20153Stated by: CVE record
- Microsoft SharePoint Server Subscription EditionAffected: ≥ 16.0.0, < 16.0.19725.20384Upgrade to: 16.0.19725.20384Stated by: CVE record
- Microsoft Sharepoint ServerAffected: < 16.0.19725.20434Upgrade to: 16.0.19725.20434Stated by: NVD
Versions as the sources state them. Full version matrix after sign-in
Steps
Written by AI from the record- Check whether your Microsoft SharePoint is one of these affected versions: SharePoint Enterprise Server 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition.
- Identify your current SharePoint build/version number from your server’s SharePoint “About”/version page.
- Compare your build to the fixed builds, and upgrade to at least one of these fixed versions: 16.0.5556.1005 (Enterprise Server 2016), 16.0.10417.20153 (Server 2019), or 16.0.19725.20384 (Subscription Edition).
- If you cannot update immediately, restrict network access to the SharePoint server (especially from the internet) and ensure only required internal networks/users can reach it until the update is applied.
- After updating, re-check the SharePoint build/version to confirm it matches or is newer than the fixed version you installed.
Coverage timeline
4 publishersActive exploitation of RCE vulnerability CVE-2026-58644 in Microsoft SharePoint Server confirmed.
Added to CISA KEV catalog
Advisory coverage
Sourced from public security reporting — each date is when it was published, not when it happened. 12 further articles named this CVE in wider roundups without reporting it as a distinct event.
What it is
From the CVE record
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
In plain language
Written by AI from the recordCVE-2026-58644 is a SharePoint flaw that lets an attacker run malicious code on your server over the network without any login—if you use affected SharePoint versions, you should treat it as urgent to update.
CVE-2026-58644 is an unauthenticated remote code execution in Microsoft SharePoint caused by unsafe deserialization of attacker-controlled network input, allowing arbitrary code execution on the SharePoint server.
If you're affected
- Complete server compromise
- Business data exposure
- Site disruption or outage
- Malware/ransomware foothold
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Listed as exploited in the wild since 2026-07-16.
US federal agencies must remediate by 2026-07-19.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
16% chance of exploitation activity in the next 30 days, which ranks it in the 97th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
Lifecycle
23 events over 97 days, from the signal feeds we watch.
- EPSS band changehigh → moderate
- EPSS band changehigh → moderateepss band change
- EPSS band changemoderate → highepss band change
- EPSS band changelow → moderate
- EPSS band changelow → moderateepss band change
- Nuclei check added
Affected products
- sharepoint serverEnterprise Software / collaboration-groupware
- Microsoft SharePoint Enterprise Server 2016Enterprise Software / itsm-monitoring
- Microsoft SharePoint Server 2019Enterprise Software / itsm-monitoring
- Microsoft SharePoint Server Subscription EditionEnterprise Software / collaboration-groupware
Technical detail
CVSS 3.1 vector
Open in the CVSS calculatorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Scored 9.8 by NVD.
How it is reached
- Attack Vector NetworkExploitable remotely over the network without any special conditions
- Attack Complexity LowNo special conditions — the attack can be reliably reproduced
- Privileges Required NoneNo authentication required — anyone can exploit this
- User Interaction NoneNo user interaction needed — fully automated exploitation
Scope
- Scope UnchangedImpact is limited to the vulnerable component itself
Impact if exploited
- Confidentiality HighTotal information disclosure — all data in the component is compromised
- Integrity HighTotal loss of integrity — attacker can modify any data in the component
- Availability HighTotal denial of service — the component is completely unavailable
Weaknesses
ATT&CK techniques
Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.
Sources
References in the record
Analysis on the cve.tools blog
- SharePoint's next 9.8: an unauthenticated RCE that was exploited before the patch shipped (CVE-2026-58644)CVE-2026-58644 is an unauthenticated, CVSS 9.8 deserialization RCE in on-prem SharePoint, exploited as a zero-day and on CISA KEV with a 2026-07-19 deadline. Here's the chain, who's affected, and why you must rotate machine keys after patching.
- SharePoint's quiet 9.1: an unauthenticated auth-bypass that unlocks a still-unpatched RCE (CVE-2026-55040)CVE-2026-55040 is an unauthenticated authentication bypass in on-prem SharePoint Server. It's not on KEV and has no public exploit - but a working Pwn2Own-grade exploit exists, it impersonates any user via forged JWTs, and patching it now breaks an unauthenticated-RCE chain whose second half is still unpatched. Who's exposed, how the chain works, and how to fix it.
- Microsoft's biggest Patch Tuesday ever: what I'd actually fix firstMicrosoft's record July 2026 Patch Tuesday brought 570+ fixes and two exploited zero-days that scored 7.8 and 5.3, not 9.8. A pentester's take on why the big red number is the wrong sort order - and exactly what to fix first.
In the news
All news- Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks
- SharePoint Vulnerability Exploited Shortly After PoC Release
- Week in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breached
- Another SharePoint RCE exploited: Patch, then rotate your machine keys (CVE-2026-50522)
- Fourth SharePoint Vulnerability Exploited in Past Month’s Wave of Attacks
- Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC
- ⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
- CVE-2026-58644: Microsoft SharePoint Server Unauthenticated Remote Code Execution Vulnerability Exploited in the Wild
- Fresh SharePoint Vulnerability Exploited Soon After Disclosure
- CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next exploited one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Sharepoint Server, not every advisory. This one: actively exploited.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI