CVE-2026-58644 (CVSS 9.8): Microsoft SharePoint Servers Are Being Hit by Active RCE Exploitation Right Now

SharePoint Server is the backbone of collaboration for thousands of enterprises across India and globally — storing financial records, project data, HR policies, board presentations, and client communications. On 14 July 2026, Microsoft’s Patch Tuesday quietly included a fix for CVE-2026-58644, a critical deserialization flaw that lets an attacker execute arbitrary code directly on your SharePoint server. Three days later, CISA added it to the Known Exploited Vulnerabilities (KEV) catalog with a federal remediation deadline of 19 July 2026. Active exploitation was already underway before the patch even shipped.

If you have an on-premises SharePoint deployment and have not applied the July 2026 cumulative updates, this is not a theoretical risk. Attackers are in the wild right now, stealing IIS machine keys, planting web shells, and establishing persistent footholds inside SharePoint farms — and they are doing it with low attack complexity and repeatable success.

What Is Happening Right Now: The Active SharePoint Campaign

CVE-2026-58644 is not a standard low-priority Patch Tuesday item. CISA’s alert, issued the same day as the KEV listing, confirms that threat actors are conducting an active campaign against internet-facing, on-premises SharePoint Server instances — precisely the configuration prevalent across India’s banking, government, and enterprise sectors where cloud migration is still in progress.

The campaign is multi-stage and deliberate. According to CISA’s advisory and corroborating vendor reporting, the confirmed post-exploitation sequence unfolds as follows:

1. Initial access via the deserialization vulnerability in CVE-2026-58644.
2. IIS machine key theft — the attacker extracts cryptographic keys from web.config that SharePoint uses to validate and sign authentication tokens. With these keys in hand, attackers can forge ViewState objects and re-exploit SharePoint deserialization even after patching, as long as the old keys remain in place.
3. Web shell deployment for persistent, interactive remote access — allowing the attacker to return days or weeks later.
4. Lateral movement into connected systems — including the SharePoint SQL Server backend, Active Directory, and downstream file shares.

The machine-key theft is the aspect that transforms this from a “patch and move on” situation into a potential incident response scenario. A SharePoint farm that was exposed before patching — and whose machine keys were not rotated — may remain under attacker control even after the July updates are applied. Patching is necessary but not sufficient.

Technical Breakdown: CVE-2026-58644 and the Chain of Vulnerabilities

CVE-2026-58644 is a deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint Server. The CVSS 3.1 base score is 9.8 Critical, with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, and the official CVSS scoring indicates no prior authentication is required.

Important note on authentication characterisation: Some Microsoft advisory language describes exploitation as requiring “at least Site Owner” permissions, while the published CVSS vector indicates no privileges required (PR:N). Rapid7 and CISA have not publicly reconciled this discrepancy. The operationally correct response is to plan for the worst case — treat this as a potentially unauthenticated RCE and patch with emergency priority — regardless of how the inconsistency resolves.

CVE-2026-58644 is not being exploited in isolation. The following CVEs are being combined in active campaigns:

CVE	Type	CVSS	Status
CVE-2026-58644	RCE via Deserialization	9.8	CISA KEV; active exploitation confirmed
CVE-2026-55040	Authentication Bypass	9.1	Chained for pre-auth RCE; second flaw embargoed until August Patch Tuesday
CVE-2026-56164	Elevation of Privilege	5.3 (understated)	CISA KEV; Microsoft acknowledges CVSS underestimates real risk
CVE-2026-32201	RCE	Not published	Observed in multi-CVE exploitation chains

CVE-2026-55040, discovered by Rapid7 Senior Principal Security Researcher Stephen Fewer, is described as “the first in a pair of exploits which, when chained together, can lead to unauthenticated remote code execution against a vulnerable SharePoint server.” The second flaw in the pair is currently under responsible disclosure embargo until Microsoft’s August 2026 Patch Tuesday — but exploitation of CVE-2026-55040 itself has already been observed in the wild.

The affected versions and minimum patched builds requiring the July 2026 Cumulative Update are:

Product	Vulnerable Build	Fixed Build
SharePoint Server 2016	Earlier than 16.0.5556.1005	16.0.5556.1005
SharePoint Server 2019	Earlier than 16.0.10417.20153	16.0.10417.20153
SharePoint SE	Earlier than 16.0.19725.20384	16.0.19725.20384

Critical patch gap: A Windows Update history entry showing the KB is installed is not sufficient verification. SharePoint farms require running PSConfig (the SharePoint Products Configuration Wizard) on every server in the farm after the Windows update installs. Farms where PSConfig has not been run remain on the pre-patch codebase even though Windows Update reports success. Verify patching via the SharePoint build number and confirm NeedsUpgrade is false for all farm databases via the SharePoint Management Shell.

India Exposure: Why This Hits Close to Home

India has a large and under-migrated base of on-premises SharePoint deployments, particularly in sectors where regulatory, data-sovereignty, or connectivity concerns have slowed the shift to Microsoft 365:

• Banking and Financial Services: Internal portals, policy repositories, and loan documentation workflows on SharePoint 2019 or older.
• Government and PSUs: Significant SharePoint 2016 footprints, often internet-facing for citizen or cross-agency access.
• IT/ITES and BPO: Client data, SLA documentation, and HR data stored on SharePoint farms.
• Manufacturing and Pharma: Quality management, compliance documentation, and regulatory submission records.

For organisations subject to SEBI’s Cybersecurity and Cyber Resilience Framework (CSCRF), RBI’s IT governance guidelines, or CERT-In’s 6-hour incident reporting obligation, a successful SharePoint compromise — especially one involving client data, financial records, or personally identifiable information — carries significant regulatory consequences alongside the operational ones. The IIS machine key theft technique means a breach may not be immediately visible: attackers who possess the keys can return silently, maintaining access across patch cycles until the keys are rotated.

What You Should Do: Actionable Defence Checklist

From a zero-trust and incident-response perspective, here is the prioritised checklist every SharePoint administrator and CISO should execute this week:

1. Patch — But Patch Correctly

• Apply the July 2026 Cumulative Update to every server in the farm — front-end, application, search, and distributed cache roles. A partial-farm patch leaves gaps.
• After installing the Windows update, run PSConfig on every farm server: psconfig.exe -cmd upgrade -inplace b2b -wait -force
• Verify via SharePoint Management Shell that NeedsUpgrade returns False for all content and configuration databases.

2. Hunt Before You Patch (Preserve Evidence First)

• Preserve IIS logs, SharePoint ULS logs, and EDR telemetry before patching — the patch process may overwrite forensic artifacts.
• Hunt for suspicious child processes of w3wp.exe (SharePoint’s IIS worker process). Web shell executions appear as unexpected child processes here.
• Audit for unexpected .aspx or .ashx files in SharePoint hive directories, _layouts folders, and virtual directories.
• Enable AMSI (Antimalware Scan Interface) integration in SharePoint if not already active — it intercepts deserialization attack payloads at runtime.

3. Rotate IIS Machine Keys

• If you cannot definitively rule out prior exposure during the vulnerability window, assume machine keys were stolen. Rotate all IIS machine keys across the entire farm before declaring the environment clean.
• Rotate service account credentials and any secrets accessible to SharePoint application pool identities.
• If farm integrity cannot be established with confidence, plan for a rebuild rather than a patch-and-proceed approach.

4. Reduce Attack Surface Immediately

• Do not expose SharePoint Central Administration to the internet — a persistent misconfiguration that dramatically increases risk across all SharePoint CVEs.
• Place SharePoint behind a Web Application Firewall (WAF) or reverse proxy capable of inspecting and filtering deserialization payloads.
• Implement zero-trust network access (ZTNA) for remote SharePoint access — replace broad VPN access with identity-verified, least-privilege sessions that enforce continuous authentication.
• If immediate patching is not possible, consider temporarily restricting internet access to SharePoint entirely until the patch window opens.

5. Plan Your Migration Path

• SharePoint Server 2016 is approaching end of mainstream support. The sustained exploitation of on-premises SharePoint — including multiple actively-exploited CVEs in 2026 alone — is a clear signal. If you have not begun planning migration to SharePoint Online or at minimum to SharePoint Subscription Edition, start now.

For professional assistance with SharePoint security hardening, zero-trust architecture design, or incident response if you suspect compromise, reach out to Sanjay Seth’s team at P J Networks for a tailored assessment.

The Bigger Picture: On-Premises Infrastructure Under Sustained Attack

CVE-2026-58644 does not exist in isolation. Over the past 90 days, high-severity, actively-exploited vulnerabilities have hit Active Directory Certificate Services, Fortinet security infrastructure, and now the core collaboration platform that links both. The pattern is unmistakable: attackers are systematically targeting the intersection of identity, collaboration, and security tooling — because compromising these systems yields access to everything downstream.

For Indian enterprise security teams, this reinforces three operational principles:

• Patch velocity matters more than patch coverage: Getting the 20% of highest-risk, internet-facing systems patched within 48 hours is more valuable than achieving 100% patch coverage over 45 days.
• Perimeter exposure must be continuously inventoried: Many organisations do not know which SharePoint servers are internet-facing. You cannot protect what you cannot see.
• Post-patch verification is a separate, required discipline: The machine key theft scenario demonstrates that “patch applied” is not equivalent to “compromise ruled out.” Verification must include threat hunting, not just update confirmation.

---

Frequently Asked Questions

Does CVE-2026-58644 affect SharePoint Online (Microsoft 365)?

No. CVE-2026-58644 affects only on-premises SharePoint Server (versions 2016, 2019, and Subscription Edition). Microsoft 365 / SharePoint Online is a cloud-managed service and Microsoft handles patching on its end. If your organisation has fully migrated to SharePoint Online, you are not affected by this specific vulnerability — though the broader principle of keeping your Microsoft identity infrastructure patched remains important.

Is this being exploited by a specific named threat group?

CISA’s public alert does not attribute the exploitation campaign to a specific named threat actor or nation-state group. The campaign characteristics — IIS machine key theft, web shell persistence, and multi-CVE chaining — are consistent with tactics used by both financially motivated ransomware affiliates and state-sponsored actors who have previously targeted SharePoint infrastructure in healthcare, government, and financial services sectors. Formal attribution has not been publicly confirmed as of this writing.

We installed the Windows update. Are we fully protected?

Not necessarily. SharePoint patching is a two-step process: (1) install the Windows cumulative update, and (2) run the PSConfig configuration upgrade wizard on every server in the farm. If PSConfig has not been run, your SharePoint farm continues to operate on the pre-patch code even though Windows Update reports the KB as successfully installed. Always verify your actual SharePoint build number rather than relying solely on Windows Update history.

What compensating controls apply if we cannot patch immediately?

If an emergency patch window cannot be opened within 24–48 hours: (1) restrict or remove internet access to the SharePoint farm entirely; (2) enable AMSI integration to intercept deserialization payloads at runtime; (3) route SharePoint and IIS logs to your SIEM with alerts on suspicious w3wp.exe child process creation and unexpected file writes in SharePoint directories; (4) place the farm behind a WAF with deserialization-aware inspection rules. These are compensating controls — they reduce risk but do not replace patching. Treat them as a bridge to an emergency change window, not a permanent posture.

---

Sources: The Hacker News — CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV | Vulert — CISA SharePoint CVE-2026-58644 KEV Analysis | Rapid7 — July 2026 Patch Tuesday | Penligent — CVE-2026-58644 Patch Validation | Field Effect — Microsoft Patch Tuesday SharePoint Vulnerabilities

---