CVE-2026-58644criticalunder attackCWE-502

CVE-2026-58644: critical vulnerability in Microsoft SharePoint Enterprise Server 2016

Microsoft SharePoint Remote Code Execution Vulnerability

Published · Updated

98Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 16%
from disclosure to weapon12 days
Published on NVDJul 14
1st PoC+12d
CISA KEV+2d
victimsAug 4
exploitation probability
16%top 3% of all CVEs
observed exploitation
yesCISA + VulnCheck
1 public exploit(s)
Appeared in 1 incident(s) we investigated
FOITT / BIT (Escritório Federal de Tecnologia da Informação e Telecomunicações da Suíça)
Action required by CISAfederal deadline: 2026-07-19

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

Microsoft SharePoint has a flaw that allows attackers to run malicious code on servers through specially crafted network requests. This happens because the software incorrectly processes untrusted data, making it easy for attackers to take complete control of affected systems.

Technical detail

CWE-502 deserialization vulnerability in SharePoint's data processing allows remote code execution via crafted network payloads without requiring authentication. An attacker can execute arbitrary code with the privileges of the SharePoint service by sending malicious serialized objects.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Affected products
Microsoft · Microsoft SharePoint Enterprise Server 2016Microsoft · Microsoft SharePoint Server 2019Microsoft · Microsoft SharePoint Server Subscription Edition
public PoCs found — 1
vulncheckvulncheck.com/xdb/3e56de5accf8unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Microsoft SharePoint Enterprise Server 2016

In the same product, most dangerous first.

CVE-2025-53770CRITICALMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 100.0%KEVCVE-2025-49704HIGHMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 100.0%KEVCVE-2023-29357CRITICALMicrosoft SharePoint Server Elevation of Privilege VulnerabilityEPSS 100.0%KEVCVE-2025-49706MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 99.1%KEVCVE-2023-24955HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 85.0%KEVCVE-2026-55040CRITICALMicrosoft SharePoint Server Security Feature Bypass VulnerabilityEPSS 69.5%KEV
References
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644