CVE-2026-58644 landed in CISA’s Known Exploited Vulnerabilities catalog yesterday, July 16. The due date for remediation is July 19 — that’s three calendar days from publication. Microsoft published the fix on July 14. CISA added it to KEV on July 16 with a classification of active exploitation, automatable, total technical impact.
This is a deserialization vulnerability (CWE-502) in Microsoft Office SharePoint that allows an unauthorized attacker to execute code over a network. CVSS 9.8: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No authentication required. No user interaction needed. Attack complexity is low.
What’s affected
Three product lines, all on x64:
- SharePoint Server 2016 Enterprise — versions prior to 16.0.5556.1005
- SharePoint Server 2019 — versions prior to 16.0.10417.20153
- SharePoint Server Subscription Edition — versions prior to 16.0.19725.20384
Most SharePoint installations in the wild are still on 2016 or 2019. Subscription Edition is newer but not yet universal. If your organization runs SharePoint and you haven’t confirmed the exact build number, this is a candidate.
How the vulnerability works
SharePoint’s deserialization layer accepts untrusted input and processes it without sufficient type validation. An attacker sends a crafted payload to a SharePoint endpoint, the deserialization routine instantiates an arbitrary object, and that object’s constructor or property setter executes code. The attack path is network-reachable and does not require a user to click anything.
CISA’s SSVC evaluation marks it as automatable — meaning an attacker doesn’t need to manually tweak the payload for each target. Once you have the endpoint URL and the SharePoint version, the exploit is one HTTP request away.
Why this is interesting beyond the CVSS score
A 9.8 deserialization RCE on SharePoint isn’t novel. SharePoint has been eating security researchers for years. What makes this one worth writing about is the combination of signals:
- KEV membership — CISA confirmed active exploitation. Not just a PoC. Not just a scanner finding. Someone is running this in the wild.
- Automatable — SSVC says an attacker can run this at scale without per-target tuning.
- Total technical impact — full confidentiality, integrity, and availability impact. This isn’t a “read one config file” vulnerability.
- No auth required — unauthenticated attack surface on a product that most organizations expose to at least their intranet, if not the full internet.
- BOD 26-04 — CISA referenced this specific BOD, which prioritizes updates based on risk and requires compliance with their forensics triage requirements.
The patch window
Microsoft patched on July 14. CISA added it to KEV on July 16. The due date is July 19.
That’s 5 days from patch publication to KEV membership, and 3 days from KEV membership to the patch deadline. CISA has been tightening the window between “known exploited” and “patch now” for several quarters. The previous window was 30 days; BOD 26-04 compressed it to 4 weeks for most items, but the combination of active exploitation and automatability means this is being treated with urgency.
For organizations with a standard patch cycle (monthly), this means an out-of-cycle patch. For organizations with weekly patching, it means this week’s patch window.
What to do in the next 48 hours
Step 1: Inventory. Run a quick build-number check on every SharePoint server:
Get-SPProduct -local | Select-Object Version
Or check the version from the web UI: Central Administration → Upgrade and Migration → Check product and patch installation status.
Compare against the affected versions listed above. If you’re on or above the patched build, you’re good.
Step 2: Patch. Download the July 2026 cumulative update from the Microsoft Security Update Guide. Apply to all affected servers. Test in a non-production environment first if your change management process requires it.
Step 3: Verify. After patching, re-run the version check. Confirm the build number matches or exceeds the patched threshold.
Step 4: Forensics triage. CISA’s BOD 26-04 requires forensic investigation for KEV entries. Check SharePoint ULS logs and IIS logs for deserialization-related errors in the window between patch publication (July 14) and your patch date. Look for:
- Unusual object types in deserialization streams
TypeLoadExceptionorSerializationExceptionaround known gadget types- Elevated CPU or memory on the SharePoint frontend during the attack window
What if you can’t patch by July 19
Two options:
Network segmentation. Restrict access to the SharePoint endpoints that accept deserialization payloads. If SharePoint is exposed to the full internet, apply a WAF rule that blocks suspicious Content-Type headers or unusually long POST bodies on the relevant endpoints.
Discontinue use. BOD 26-04 says stakeholders can “discontinue use of the product if mitigations are unavailable.” If you have a SharePoint install that’s isolated, not internet-facing, and low priority, turning it off is a valid mitigation.
The pattern
SharePoint is a recurring entry in the KEV catalog. It’s internet-facing, widely deployed, and has a rich attack surface. The deserialization family of bugs in SharePoint is particularly persistent because the platform accepts serialized objects from multiple sources — web services, workflow engines, custom solutions, and third-party add-ins.
CVE-2026-58644 is not the most severe SharePoint vulnerability this year. But the KEV entry plus the automatable classification plus the compressed patch window makes it a higher-priority item than the raw CVSS score alone would suggest.