Critical SharePoint RCE (CVE-2026-58644) Under Active Attack After Patch Sat Hidden for a Month

A critical remote code execution vulnerability in Microsoft SharePoint is being actively exploited in the wild, and there's a twist that should make every IT administrator sit up: Microsoft shipped the fix in its June 2026 Patch Tuesday release, but the vulnerability itself wasn't publicly documented until July 14, 2026. That month-long gap means some organizations were silently protected by automatic updates, while others — unaware the flaw even existed — remained exposed to functional exploit code circulating among attackers.

What Happened

On July 14, 2026, Microsoft publicly disclosed CVE-2026-58644, a critical remote code execution vulnerability affecting multiple versions of Microsoft SharePoint Server. Carrying a CVSS base score of 9.8 out of 10 — about as severe as vulnerability ratings get — the flaw allows an attacker to execute arbitrary code on a targeted SharePoint server through the insecure deserialization of untrusted data.

Just two days later, on July 16, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog — a formal acknowledgment that the flaw is being weaponized against real targets. CISA's own Vulnrichment assessment flagged the exploitation status as "active," the automatability as "yes," and the technical impact as "total," a trifecta that places this bug firmly in the drop-everything-and-patch category.

What makes CVE-2026-58644 particularly noteworthy is the timeline discrepancy. Microsoft's patch was released as part of the June 9, 2026 Patch Tuesday cycle, but according to analysis in the vulnerability knowledge base, the CVE documentation was inadvertently omitted and not published until July 14, 2026. As one analyst noted, this means "organizations may have unknowingly patched it or overlooked it during vulnerability scanning." In other words, whether your organization is safe today may come down to whether you diligently apply every monthly security update — even for bugs you didn't know you had.

Understanding the Vulnerability

At its core, this is a deserialization of untrusted data vulnerability, classified under CWE-502. To understand why that's dangerous, it helps to understand what serialization actually does.

When an application needs to store or transmit a complex object — say, a data structure containing user settings, document metadata, or configuration state — it converts (serializes) that object into a compact stream of bytes. On the receiving end, the application reverses the process (deserializes it), reconstructing the original object in memory. The problem arises when an application deserializes data that came from an untrusted source without properly validating it first. A malicious actor can craft a poisoned serialized payload that, when reconstructed by the server, triggers the execution of attacker-chosen code rather than simply rebuilding a benign data object.

Think of it like receiving a piece of flat-pack furniture with assembly instructions. Normally you follow the instructions and end up with a bookshelf. But if a malicious party swaps out the instruction sheet, following the steps could instead assemble something that hands over the keys to your entire house. SharePoint, in this case, follows the "instructions" embedded in the serialized payload — and a crafted payload instructs it to run arbitrary code.

Here is where the intelligence gets interesting, and where defenders need to pay close attention. The official CVSS vector string is:

1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

Breaking that down:

• AV:N (Attack Vector: Network) — exploitable remotely over the network.
• AC:L (Attack Complexity: Low) — no special or hard-to-arrange conditions required.
• PR:N (Privileges Required: None) — per the score, no authentication needed.
• UI:N (User Interaction: None) — no victim clicks required.
• S:U (Scope: Unchanged)
• C:H / I:H / A:H — complete impact to confidentiality, integrity, and availability.
• E:F (Exploit Code Maturity: Functional) — functional exploit code exists.
• RL:O (Remediation Level: Official Fix) — an official patch is available.
• RC:C (Report Confidence: Confirmed) — the vulnerability is confirmed.

The official Microsoft CVE description reinforces the unauthenticated angle, stating that the flaw "allows an unauthorized attacker to execute code over a network." However, analysts flagged a notable conflict in the vendor documentation. As one analyst wrote: "There is a direct conflict between the vendor's CVSS score and their technical description. The CVSS base score of 9.8 maps to an attack vector requiring no privileges (PR:N). However, the MSRC FAQ explicitly states that an attacker must be 'authenticated as at least a Site Owner.'"

For practical threat modeling, defenders should treat this as a post-authentication RCE requiring at least Site Owner privileges, while remaining aware that the CVSS score reflects an unauthenticated worst case. Crucially, Site Owner privileges are not an insurmountable barrier — as one analyst noted, they "can sometimes be obtained via credential theft, brute force, or other vulnerabilities." In a chained attack, a lower-privileged foothold could be escalated to Site Owner, at which point this bug becomes a launchpad for full server compromise.

The Attack Chain

Drawing directly from the consolidated intelligence, the exploitation sequence unfolds as follows:

1. Authenticate to the target SharePoint environment as at least a Site Owner.
2. Transmit a maliciously crafted serialized payload over the network to a vulnerable endpoint.
3. The SharePoint Server deserializes the untrusted data without proper validation.
4. Arbitrary code is injected and executed remotely on the SharePoint Server.

The knowledge base notes that functional exploit code is available and "works reliably in most situations where the vulnerability exists." However, analysts also flagged an intelligence gap: while the advisory states functional exploit code is available, explicit URLs to public Proof-of-Concept (PoC) code were not provided in the sources, and the specific malicious payload contents remain undocumented. No public PoC code was included in the reference material for this writeup.

Who Is Affected

The CVE record from Microsoft identifies three affected products with specific version thresholds. Note that while the earlier knowledge base extraction referenced only SharePoint 2016 editions, the authoritative CVE record expands the affected products to include SharePoint Server 2019 and the Subscription Edition:

The fixes were delivered via the June 2026 Patch Tuesday release, dated June 9, 2026.

SharePoint is one of Microsoft's most widely deployed collaboration and document management platforms, serving as the backbone for intranets, file repositories, and team workspaces across enterprises, government agencies, healthcare systems, and educational institutions worldwide. Because SharePoint servers frequently sit deep inside corporate networks and are often integrated with Active Directory, a compromised SharePoint host can serve as an ideal pivot point for attackers seeking to expand their access across an entire organization.

Real-World Risk

This is not a theoretical concern. The vulnerability is confirmed to be exploited in the wild, a fact reinforced by both its inclusion in the CISA KEV catalog on July 16, 2026, and CISA's Vulnrichment assessment rating exploitation as "active." According to the knowledge base, in-the-wild exploitation was first observed prior to July 14, 2026 — meaning attackers were leveraging this flaw before the CVE was even publicly documented.

The consolidated intelligence describes the maximum impact bluntly: full system compromise via remote code execution. The business impact assessment warns of a "complete loss of confidentiality, integrity, and availability on the affected SharePoint server," which could lead to:

• Massive data theft of sensitive documents and corporate files stored in SharePoint.
• Full network pivoting — attackers using the compromised server as a beachhead to move laterally through the enterprise.
• Data destruction or ransomware deployment.
• Compromise of the broader Active Directory environment, if the server is highly privileged.

The specific data at risk includes SharePoint databases and document repositories, user credentials and session tokens, underlying server files and configurations, and — where the server holds elevated privileges — the Active Directory environment itself.

There are, however, intelligence gaps worth acknowledging. As of the source reporting, the specific threat actors and campaigns exploiting this vulnerability remain unidentified, and no network or host-based Indicators of Compromise (IOCs), YARA rules, or Sigma rules have been publicly disclosed. This absence of published IOCs makes proactive detection more challenging and places greater emphasis on behavioral monitoring and prompt patching.

What You Should Do

Given the confirmed active exploitation, the availability of functional exploit code, and CISA's KEV listing, this vulnerability demands immediate attention.

1. Apply the patch immediately. Deploy the June 2026 Patch Tuesday security update to all affected SharePoint installations. Confirm your servers are at or above the following fixed build numbers:

• SharePoint Enterprise Server 2016: 16.0.5556.1005 or later
• SharePoint Server 2019: 16.0.10417.20153 or later
• SharePoint Server Subscription Edition: 16.0.19725.20384 or later

Because the patch predates the public CVE disclosure by over a month, verify your patch level directly rather than assuming coverage — organizations enrolled in automated monthly patching may already be protected, but this should be confirmed, not presumed.

2. Audit Site Owner privileges. Since practical exploitation requires at least Site Owner access, review all SharePoint accounts holding 'Site Owner' or higher privileges and ensure only trusted, authorized personnel possess these rights. Removing unnecessary elevated privileges shrinks the attack surface.

3. Hunt for signs of past compromise. Because the vulnerability was exploited in the wild before public disclosure, assume you may have been targeted and review your logs accordingly. Specifically:

• Monitor for suspicious or unauthorized accounts gaining 'Site Owner' privileges.
• Review SharePoint application logs for deserialization errors or anomalous exceptions.
• Look for anomalous Site Owner activity involving object creation, deployment, or configuration changes that could trigger deserialization.

4. Deploy and tune EDR on SharePoint servers. Endpoint Detection and Response tooling can catch post-exploitation activity. Watch endpoint telemetry for unexpected child processes spawning from w3wp.exe (the IIS worker process) or SharePoint-specific services — for example, cmd.exe or powershell.exe being launched by the SharePoint web application pool is a strong red flag.

Note that Microsoft published no workarounds for this vulnerability. Patching is the definitive remediation. If you cannot patch immediately, tightening Site Owner access and heightening monitoring are the only mitigating measures available — and they are stopgaps, not solutions.

The Bigger Picture

CVE-2026-58644 is a case study in why disciplined, comprehensive patch management matters more than chasing individual CVE headlines. Here is a critical, actively exploited flaw whose fix was quietly sitting in a routine monthly update a full month before anyone outside the attacker community knew to look for it. Organizations that treat Patch Tuesday as a non-negotiable monthly ritual were protected without ever knowing the danger. Those who cherry-pick updates based on published CVE severity — or who defer patching until a vulnerability makes news — were left exposed to functional exploit code for weeks.

The episode also underscores a recurring theme in the SharePoint threat landscape: deserialization flaws (CWE-502) have repeatedly proven to be a rich vein for attackers targeting Microsoft's collaboration platform. SharePoint's deep integration into enterprise identity infrastructure means that a single deserialization bug can escalate from a foothold into a full-domain compromise. Security teams should treat SharePoint servers as high-value, high-risk assets deserving of the same scrutiny as domain controllers.

Finally, the discrepancy between the CVSS score (PR:N, implying no authentication) and the vendor's FAQ (requiring Site Owner privileges) is a reminder that CVSS numbers, while useful for triage, do not tell the whole story. Read the vendor's technical description carefully, model the realistic attack path for your environment, and remember that authentication requirements can and do get bypassed through credential theft and vulnerability chaining. Watch for the eventual publication of IOCs and PoC details, and in the meantime, patch, audit your privileges, and hunt through your logs as though you've already been targeted — because for this vulnerability, you may well have been.