Full research report

CVE-2026-58644: Microsoft SharePoint Server Unauthenticated Remote Code Execution Vulnerability Exploited in the Wild

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

CVE-2026-58644 is the most recently confirmed member of an ongoing multi-CVE SharePoint exploitation campaign that has been active since at least April 2026 (CVE-2026-32201, KEV-added April 14). The campaign demonstrates a consistent post-exploitation pattern — IIS machine key theft enabling persistent token forgery — suggesting an organised threat actor with a repeatable playbook rather than opportunistic scanning. A significant unresolved discrepancy exists between the CVSS PR:N score (unauthenticated) and Microsoft's advisory language (Site Owner required); until clarified, defenders should treat the lower-privilege path as plausible given active exploitation without full public disclosure of the method. With approximately 10,000 internet-exposed instances and a federal three-day remediation deadline, the window for unpatched organisations is critically narrow. The absence of public PoC code suggests exploitation remains within the hands of actors who either discovered or purchased the capability, making rapid patching the primary defensive lever.

What happened

Microsoft released patches for CVE-2026-58644, a critical (CVSS 9.8) deserialization of untrusted data flaw in SharePoint Server, on Patch Tuesday 14 July 2026. The vulnerability was not initially flagged as exploited, but Microsoft revised its advisory by 15 July to confirm zero-day exploitation in the wild prior to patch availability. CISA added CVE-2026-58644 to its Known Exploited Vulnerabilities (KEV) catalogue on 16 July 2026, alongside three previously exploited SharePoint CVEs (CVE-2026-32201, -45659, -56164) and two Fortinet FortiSandbox flaws (CVE-2026-25089, CVE-2026-39808), imposing a 19 July 2026 remediation deadline on federal agencies.

Affected scope

All supported on-premises SharePoint Server editions: Subscription Edition (prior to 16.0.19725.20384), Server 2019 (prior to 16.0.10417.20153), and Enterprise Server 2016 (prior to 16.0.5556.1005). Shadowserver identified approximately 10,000 internet-exposed SharePoint servers globally, with at least 800 unpatched against earlier CVEs at the point of the July 14 release. SharePoint Online (Microsoft 365) is not affected. Fortinet FortiSandbox appliances are separately affected by CVE-2026-25089 and CVE-2026-39808.

Technical assessment

CVE-2026-58644 stems from CWE-502 (deserialisation of untrusted data) in the SharePoint Server core. The NVD CVSS vector (AV:N/AC:L/PR:N/UI:N) scores it as requiring no privileges and no user interaction, enabling unauthenticated network exploitation with low attack complexity. Threat actors chaining the four SharePoint CVEs have been observed performing post-exploitation IIS machine key harvesting — which enables forging of ViewState and authentication tokens — followed by deserialisation-based persistence techniques and malware deployment. Microsoft published two AMSI-based Defender detection signatures targeting anomalous request bodies and headers associated with these exploitation patterns.

Recommended defensive actions

  1. Apply the July 2026 Patch Tuesday cumulative updates immediately: SharePoint Subscription Edition ≥16.0.19725.20384, Server 2019 ≥16.0.10417.20153, Enterprise Server 2016 ≥16.0.5556.1005.
  2. Before rotating IIS machine keys, scan for and remove any key-harvesting artefacts or implants; rotating keys while a harvesting tool remains present will not prevent token forgery with previously stolen keys.
  3. Enable and verify AMSI integration on every SharePoint web application to surface the Defender signatures 'Exploit:Script/SuspSignoutReqBody.A' and 'Exploit:Script/ToolPaneAuthBypass.A'.
  4. Remove direct internet exposure of SharePoint Server where not operationally required; restrict SharePoint Central Administration to internal networks and constrain farm/database communications to required systems only.
  5. Establish tailored logging for exploitation indicators (anomalous ViewState requests, unexpected outbound IIS worker process connections) and hunt for signs of prior compromise given the confirmed zero-day window.

Uncertainties and evidence gaps

  • Authentication requirement discrepancy: the CVSS vector assigns PR:N (no privileges required), consistent with the headline 'unauthenticated RCE', but Microsoft's advisory text states the attacker must be 'authenticated as at least a Site Owner'. It is unclear whether these describe two distinct exploitation paths, a scoring error, or a vendor description inconsistency.
  • No threat actor, nation-state group, or malware family has been publicly attributed to exploitation of CVE-2026-58644 at time of research.
  • The full exploit chain, including any chaining of CVE-2026-58644 with the authentication-bypass flaw CVE-2026-55040 (CVSS 9.1, assessed by Microsoft as 'more likely to be exploited'), has not been publicly detailed.
  • The extent of compromise during the zero-day window between first exploitation and the July 14 patch is unknown; no victim organisations have been publicly named.
  • The BleepingComputer article (likely published on or near July 14) reported CVE-2026-58644 as not yet confirmed exploited, while articles from July 17 confirm exploitation — indicating the exploitation status changed within that three-day window, but the precise first-exploitation date is not established.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessNetwork-reachable SharePoint Server; CVSS vector indicates no authentication required, though Microsoft advisory text references Site Owner privilege — see uncertainties
ComponentSharePoint Server core deserialisation layer (all supported on-premises editions)
MechanismDeserialisation of attacker-controlled untrusted data (CWE-502) triggers arbitrary code execution in the context of the SharePoint application pool
ImpactFull remote code execution on the server, enabling persistence via IIS machine key theft, forged ViewState tokens, and subsequent malware deployment
DetectionMicrosoft Defender AMSI signatures: 'Exploit:Script/SuspSignoutReqBody.A' (request body) and 'Exploit:Script/ToolPaneAuthBypass.A' (request header); anomalous IIS worker process network connections
MitigationApply July 2026 Patch Tuesday updates: SharePoint Subscription Edition 16.0.19725.20384+, Server 2019 16.0.10417.20153+, Enterprise Server 2016 16.0.5556.1005+
Exploitation status

CVE-2026-58644 confirmed exploited in the wild as a zero-day prior to the July 14 patch; CISA added it to the KEV catalogue on July 16, 2026. Related SharePoint CVEs-2026-32201, -45659, and -56164 also actively exploited; no public PoC identified for any of the six CVEs at time of research.

Research process

Research began with the two supplied outlets (Rapid7 and The Hacker News) to establish the core technical facts, then moved to NVD for authoritative scoring and affected version numbers. A targeted search for public PoC code found none. A second search on the broader SharePoint exploitation campaign confirmed the IIS machine key theft post-exploitation chain and surfaced Shadowserver exposure data. The CISA alert page was attempted but returned 403; its content was corroborated through multiple independent secondary sources, including BleepingComputer and Field Effect. A material authentication discrepancy between the CVSS PR:N score and Microsoft's advisory text is flagged as the primary outstanding uncertainty.

  1. What are the confirmed technical details, affected versions, and exploitation status of CVE-2026-58644?
    Fetched the Rapid7 Emergency Threat Response advisory
    rapid7.com ↗

    CVSS 9.8, CWE-502, affects SharePoint 2016/2019/Subscription Edition; CISA KEV addition confirmed July 16; no public PoC; two AMSI Defender signatures published

    why Rapid7 ETR advisories are a reliable primary technical source; established the baseline facts and patch timeline

  2. Does The Hacker News reporting add detail on the CISA advisory or the exploitation confirmation timeline?
    Fetched The Hacker News article
    thehackernews.com ↗

    Confirmed Microsoft revised its bulletin after initial release to mark CVE-2026-58644 as exploited; federal deadline July 19; CISA hardening guidance includes six specific measures; Fortinet FortiSandbox CVE-2026-25089 and CVE-2026-39808 added to KEV same day

    why Corroborates the zero-day confirmation timeline and surfaces the Fortinet co-additions relevant to the full scope of CISA's July 16 KEV update

  3. What are the authoritative CVSS vector, CWE classification, and precise fixed version numbers?
    Fetched the NVD vulnerability detail page
    nvd.nist.gov ↗

    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8; CWE-502; fixed versions: 2016 ≥16.0.5556.1005, 2019 ≥16.0.10417.20153, SE ≥16.0.19725.20384

    why NVD is the authoritative record for CVSS scoring; the PR:N value (no privileges required) conflicts with Microsoft's advisory text referencing Site Owner access, flagged as material uncertainty

  4. Is there any public proof-of-concept exploit code for CVE-2026-58644?
    Web search for PoC code and GitHub repositories

    No public PoC or exploit code identified across search results; no GitHub repositories named; SecurityWeek and BleepingComputer both report no PoC available

    why Absence of PoC is itself a meaningful defensive data point; confirms exploitation is currently limited to threat actors with independently developed capability

  5. What is the broader SharePoint exploitation campaign involving the other three KEV CVEs, and what post-exploitation activity has been observed?
    Web search on CISA advisory for CVE-2026-56164/-32201/-45659 and IIS machine key exploitation

    Attackers are chaining multiple SharePoint flaws to achieve RCE, then harvesting IIS machine keys to forge authentication tokens and establish persistence before deploying malware; CISA confirmed exploitation of all four SharePoint CVEs

    why Establishes that CVE-2026-58644 is one component in an active multi-CVE SharePoint campaign, not an isolated incident

  6. Does BleepingComputer provide additional detail on the exploitation chain or exposure scale?
    Fetched BleepingComputer article on CISA SharePoint warning
    bleepingcomputer.com ↗

    Shadowserver data: ~10,000 internet-exposed SharePoint servers globally; 800+ unpatched against CVE-2026-32201 and CVE-2026-45659 at patch release; article (likely July 14) described CVE-2026-58644 as not yet confirmed exploited at that date

    why Provides quantified exposure surface; the earlier exploitation status aligns with timeline — CVE-2026-58644 exploitation was confirmed between July 14 and July 16

  7. Does the ZDI review add independent technical context or attribution?
    Fetched Zero Day Initiative July 2026 Patch Tuesday review
    zerodayinitiative.com ↗

    ZDI noted a related CWE-502 SharePoint flaw (CVE-2026-50522) was demonstrated at Pwn2Own Berlin; ZDI's July 14 assessment of CVE-2026-58644 was 'not currently exploited' — consistent with the pre-KEV timeline; no actor attribution

    why Provides independent technical corroboration of the CWE-502 root cause pattern across multiple SharePoint CVEs in this release; confirms no actor attribution is publicly available

Named in this story
TargetsMicrosoft SharePoint Server on-premises deploymentsFederal Civilian Executive Branch agenciesEnterprise organisations running SharePoint Server 2016, 2019, or Subscription Edition
Related CVEs CVE-2026-58644CVE-2026-56164CVE-2026-45659CVE-2026-32201CVE-2026-25089CVE-2026-39808

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 7 registered sources supplied useful evidence (4 primary, 2 corroborating, 1 contextual and 0 PoC/exploit references). 54 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
CISA KEVkev ok1647 records Primary evidence7 matched items Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. Supplied a vendor or government advisory opened and verified during focused research.
NVDcve ok900 records Primary evidence1 matched items Supplied a vendor or government advisory opened and verified during focused research.
Rapid7news ok3 records Primary evidence2 matched items Published the source report used to frame and date the event. Supplied a vendor or government advisory opened and verified during focused research.
The Hacker Newsnews ok12 records Primary evidence1 matched items Published the source report used to frame and date the event.
BleepingComputernews ok8 records Corroborating1 matched items Supplied independent analysis opened and verified during focused research.
CISA Alertsnews ok empty0 records Corroborating1 matched items A page from this source was opened and verified during focused research.
FIRST EPSSepss ok6800 records Context6 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5307 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok257 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok661 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1005 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok12 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok9 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1583 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 4 opened outside the registered collection
References & evidence
Vulnerability & exploitation12
CVE-2026-58644 CISA KEV Microsoft SharePoint · added 2026-07-16 CISA catalog ↗
CVE-2026-39808 CISA KEV Fortinet FortiSandbox · added 2026-07-16 CISA catalog ↗
CVE-2026-25089 CISA KEV Fortinet FortiSandbox · added 2026-07-16 CISA catalog ↗
CVE-2026-56164 CISA KEV Microsoft SharePoint Server · added 2026-07-14 CISA catalog ↗
CVE-2026-45659 CISA KEV Microsoft SharePoint Server · added 2026-07-01 CISA catalog ↗
CVE-2026-32201 CISA KEV Microsoft SharePoint Server · added 2026-04-14 CISA catalog ↗
CVE-2026-25089 EPSS 36.1% 98th percentile exploitation probability
CVE-2026-32201 EPSS 22.8% 97th percentile exploitation probability
CVE-2026-39808 EPSS 84.2% 100th percentile exploitation probability
CVE-2026-45659 EPSS 3.2% 87th percentile exploitation probability
CVE-2026-56164 EPSS 5.6% 92th percentile exploitation probability
CVE-2026-58644 EPSS 1.5% 71th percentile exploitation probability
Vendor & gov advisories3
Rapid7 Emergency Threat Response: CVE-2026-58644 Microsoft SharePoint Server Unauthenticated RCE Exploited in the Wild rapid7.com ↗

Primary technical advisory confirming CVSS 9.8, CWE-502 root cause, Defender detection signatures, and patch version numbers

NVD – CVE-2026-58644 Detail nvd.nist.gov ↗

Authoritative record: CVSS:3.1/AV:N/AC:L/PR:N/UI:N score of 9.8, CWE-502, and fixed version numbers for all three affected SharePoint editions

CISA Urges SharePoint Hardening After New Exploitations cisa.gov ↗

Primary government advisory confirming active exploitation of four SharePoint CVEs and issuing six hardening measures; page returned 403 during fetch but content confirmed through multiple secondary sources

Analysis & research4
Zero Day Initiative – The July 2026 Security Update Review zerodayinitiative.com ↗

Independent technical review noting a related CWE-502 flaw (CVE-2026-50522) was demonstrated at Pwn2Own Berlin; confirms CVE-2026-58644 characteristics and deployment urgency

SecurityWeek – Fresh SharePoint Vulnerability Exploited Soon After Disclosure securityweek.com ↗

Corroborating coverage noting rapid exploitation after disclosure and referencing Shadowserver data on ~10,000 internet-exposed SharePoint servers

BleepingComputer – CISA Warns Admins to Patch Actively Exploited SharePoint Flaws bleepingcomputer.com ↗

Describes IIS machine key theft post-exploitation chain and notes Shadowserver identified 800+ unpatched instances as of the July 14 patch release

The Hacker News – CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV thehackernews.com ↗

Confirms Microsoft revised its bulletin post-release to mark CVE-2026-58644 as exploited in the wild, and details the July 19 federal remediation deadline