FEDERAL DEADLINE TODAY: CVE-2026-58644 SharePoint Zero-Day (CVSS 9.8) Exploited in the Wild — CISA Mandates Immediate Patching

The clock just hit zero. As of today, July 19, 2026, every U.S. Federal Civilian Executive Branch (FCEB) agency that runs an on-premises Microsoft SharePoint Server is legally required to have patched CVE-2026-58644 — a CVSS 9.8 Critical unauthenticated remote code execution vulnerability that was being actively exploited before a patch even existed. If your organisation is still running SharePoint Server on-premises and has not applied the July 2026 Patch Tuesday updates, threat actors may already be inside your environment right now.

How CVE-2026-58644 Works: Deserialization, No Password Required

At its core, CVE-2026-58644 is a deserialization of untrusted data bug (CWE-502) in Microsoft SharePoint Server. Deserialization vulnerabilities have been a recurring nightmare in enterprise software for over a decade because they allow an attacker to craft a malicious serialized payload — essentially a poisoned data object — and send it to the server, which then unwraps and executes it as trusted code.

What makes CVE-2026-58644 particularly dangerous is the attack profile:

• Network-based, no authentication required: An attacker does not need stolen credentials, phishing access, or an inside foothold. A single HTTP request from the internet is sufficient to trigger the vulnerability against an exposed SharePoint server.
• Low attack complexity: No special knowledge of the target environment is required. The vulnerability is straightforward to weaponise once the deserialization gadget chain is understood — and based on the zero-day exploitation, attackers had already done the research before Microsoft could ship a patch.
• CVSS 9.8: The near-maximum score reflects the combination of unauthenticated access, network reachability, high impact on confidentiality, integrity, and availability, and low attack complexity.

Once remote code execution is achieved, observed post-exploitation activity follows a consistent and alarming playbook. Threat actors have been seen stealing Internet Information Services (IIS) machine keys from compromised SharePoint hosts. These machine keys are used by IIS and ASP.NET to encrypt, decrypt, and validate session tokens and other sensitive data. With these keys, an attacker can forge valid session tokens, authenticate as any user — including administrators — and launch additional deserialization attacks against any application on the same server or networked infrastructure that trusts those keys. This pivoting technique allows attackers to achieve deep, persistent access that survives even a simple password reset.

The Broader SharePoint Exploitation Campaign: Four CVEs, One Coordinated Threat

CVE-2026-58644 does not exist in isolation. It is the most critical piece of a coordinated SharePoint exploitation campaign that CISA formally warned about in its July 14 advisory. Across 2026, CISA has added the following SharePoint vulnerabilities to its KEV catalog:

CVE	Severity	Type	CISA KEV Date	Status
CVE-2026-32201	High	RCE	April 14, 2026	Active
CVE-2026-45659	High (8.8)	Deserialization RCE	July 1, 2026	Active
CVE-2026-56164	Critical	RCE	July 14, 2026	Active
CVE-2026-58644	Critical (9.8)	Unauth Deserialization RCE	July 16, 2026	Zero-Day — Patch NOW

The pattern is unmistakable: threat actors have been systematically targeting SharePoint Server infrastructure throughout 2026. CISA notes that since November 2021, it has flagged 11 Microsoft SharePoint vulnerabilities exploited in attacks, seven of which have been involved in ransomware campaigns. Organisations that have not completed their SharePoint patching backlog are not just vulnerable to CVE-2026-58644 — they may be vulnerable to the entire chain.

Researchers at BleepingComputer and SecurityWeek have noted that Shadowserver is currently tracking approximately 10,000 internet-exposed SharePoint servers, with over 800 still unpatched for the earlier KEV-listed CVEs — a sobering indicator that enterprise patching velocity remains dangerously slow relative to attacker exploitation speed.

Who Is at Risk? India and Enterprise Context

On-premises SharePoint Server deployments remain common across large enterprises, government departments, banking and financial services institutions, and the public sector in India. Unlike SharePoint Online (Microsoft 365), which is managed and patched by Microsoft, every on-premises SharePoint Server installation must be manually patched by the organisation’s IT team.

Indian enterprises are frequently slower to apply patches due to change-management bureaucracy, concerns about business disruption, and stretched IT teams managing legacy infrastructure. This creates a window of opportunity for threat actors — and given that July 2026’s Patch Tuesday was the largest in Microsoft’s history, with 621 CVEs addressed, there is a very real risk that SharePoint patches have been deprioritised in favour of more visible workloads.

The IIS machine key theft technique observed in post-exploitation is especially concerning for organisations running multiple ASP.NET applications on the same server or server farm as SharePoint. Stolen machine keys can be used to attack session handling across the entire application estate, not just SharePoint — meaning a successful compromise of a SharePoint server could become a foothold into payroll systems, ERP portals, or internal web applications sharing the same IIS infrastructure.

What You Should Do Right Now: Sanjay Seth’s Defensive Playbook

If you are responsible for on-premises SharePoint Server infrastructure, the following actions are time-critical. This is not a routine patch cycle — it is an emergency response:

1. Patch Immediately — All Three Generations

Apply the July 2026 Patch Tuesday security updates for all your on-premises SharePoint versions. Do not delay for change-management cycles; declare an emergency maintenance window tonight if necessary:

• SharePoint Server Subscription Edition: Apply KB5002863 (build 16.0.19725.20280)
• SharePoint Server 2019: Apply KB5002870 (build 16.0.10417.20128)
• SharePoint Enterprise Server 2016: Apply KB5002868 (build 16.0.5552.1002)

2. Rotate IIS Machine Keys — Treat Them as Compromised

If your SharePoint server was internet-exposed at any point before today’s patching, assume the IIS machine keys may have been stolen. Rotate them immediately using the IIS Manager UI (Machine Key under each site’s ASP.NET settings, or via PowerShell with Get-WebConfiguration/Set-WebConfiguration). After rotation, invalidate all active sessions — this will log out all current users but is necessary to prevent token-forgery attacks with stolen keys.

3. Isolate Internet-Facing SharePoint

If your SharePoint Server must be accessible from the internet, put it behind a Web Application Firewall (WAF) or a reverse proxy with strict inbound inspection. Apply a Zero Trust posture: no direct internet exposure without authenticated context. Consider routing remote access through a VPN or ZTNA solution rather than exposing SharePoint directly on port 443.

4. Hunt for Indicators of Compromise

Review SharePoint ULS (Unified Logging Service) logs and IIS access logs for suspicious deserialization payloads — look for POST requests to /_layouts/, /_vti_bin/, and /sites/ endpoints from unexpected source IPs. Check Windows Event Logs for unusual process spawning from w3wp.exe (the IIS worker process), which would indicate code execution. Tools like Rapid7’s ETR advisory provide specific detection guidance.

5. Evaluate the Migration Case

Every SharePoint Server incident underscores the structural risk of maintaining on-premises deployments. This is the fourth SharePoint RCE added to CISA’s KEV list in 2026 alone. If you are still on-premises, now is the right moment to build the business case for migration to SharePoint Online / Microsoft 365. Cloud-hosted SharePoint is patched automatically by Microsoft and does not carry this attack surface. The total cost of ownership calculation looks very different when you factor in emergency patching, incident response, and potential breach costs.

We have previously covered the escalating CISA mandates around enterprise software — including the Fortinet FortiSandbox emergency patch mandate — and the pattern is consistent: attackers exploit known vulnerabilities faster than enterprises patch them. The FortiBleed campaign demonstrated precisely how ransomware groups industrialise unpatched enterprise appliances into mass-breach operations.

Why This Matters: The Zero-Day Gap Is Closing

The most significant aspect of CVE-2026-58644 is not the CVSS score — it is the timing. Microsoft patched this vulnerability on July 14, 2026. CISA confirmed active in-the-wild exploitation and listed it on KEV on July 16 — just two days later. The gap between patch release and confirmed weaponisation is now measured in hours to days, not weeks or months.

This is the new threat reality: patch cycle times that were once acceptable — two weeks, a month, “next maintenance window” — are now operationally dangerous. Threat actors have access to automated vulnerability research tools, public patch-diff analysis, and ready-made deserialization gadget libraries that allow them to develop and deploy exploits for critical vulnerabilities almost immediately after patch release. For a zero-day like CVE-2026-58644, exploitation was already underway before the patch shipped.

The implication for enterprise security teams, especially those managing complex, multi-application server environments like SharePoint farms, is stark: emergency patching procedures must become a standard capability, not an exception. Organisations that cannot patch a CVSS 9.8 zero-day within 24-48 hours of patch availability are structurally exposed in the current threat landscape.

Frequently Asked Questions

Does CVE-2026-58644 affect SharePoint Online (Microsoft 365)?

No. CVE-2026-58644 affects only on-premises SharePoint Server deployments — specifically SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. SharePoint Online is hosted and managed by Microsoft and was not affected by this vulnerability.

What if we cannot patch immediately due to business constraints?

If an immediate patch is not possible, apply emergency mitigations: block all inbound internet access to SharePoint at the network/firewall level, restrict access to VPN-authenticated users only, enable enhanced logging on IIS and SharePoint ULS logs, and treat the server as potentially compromised. Escalate to your CISO immediately — this is an emergency, not a standard patch queue item. If you need guidance on rapidly implementing these controls, contact our team.

How do we know if we have already been compromised?

Key indicators include: unusual processes spawned by w3wp.exe in Windows Event Log, suspicious POST requests to SharePoint REST API or _layouts endpoints in IIS logs, unexpected outbound connections from the SharePoint server, new scheduled tasks or services created on the server, and any signs of lateral movement from the SharePoint server to other internal systems. Run an immediate threat hunt using your EDR solution focused on the SharePoint server hosts. Contact a specialist if you find anything suspicious.

Is this related to the earlier SharePoint CVEs already covered in Microsoft’s July Patch Tuesday roundup?

Yes and no. CVE-2026-58644 was patched in the same July 14, 2026 Patch Tuesday update cycle we covered earlier this week, but it was confirmed as actively exploited and added to CISA’s KEV list on July 16 — after our Patch Tuesday analysis. The July 19 federal deadline and the zero-day confirmation make this a separate, urgent action item requiring immediate attention beyond a standard patch Tuesday response.

---