{"id":"sharepoint-deserialization-exploited-jul-2026","category":"patch","status":"closed","title":"Microsoft SharePoint Server deserialisation flaw CVE-2026-58644 exploited; fixes available","tldr":"Attackers are exploiting CVE-2026-58644 to run code on organisations' SharePoint servers. Fixes exist for all three affected editions. Ask your IT provider to install current security updates and check the servers for signs of intrusion.","summary":"CVE-2026-58644 affects organisations running their own Microsoft SharePoint Server 2016, 2019 or Subscription Edition installations. It mishandles untrusted data when converting it into software objects, allowing remote code execution. Microsoft confirms exploitation, and CISA listed it on 16 July. Microsoft's advisory contains conflicting login requirements: its CVSS assessment says no privileges are needed, while its FAQ describes an attacker signed in as a Site Owner. Fixes are available for all three affected editions. Microsoft says the fix was released in June but the CVE was omitted from that month's announcements; its linked June update pages confirm the fixed builds. Rapid7 recommends installing all July security updates and checking for intrusion. Canada's Cyber Centre also warns that SharePoint 2016 and 2019 reached end of life on 14 July. As at 3 November, the reviewed sources do not establish the number of victims or that attacks have ended.","action":"If your business or family office runs its own SharePoint servers, ask its IT provider to install the latest security updates on every server and check for signs of intrusion. SharePoint 2016 and 2019 installations should also be migrated to a supported version.","product":"Microsoft SharePoint Server 2016, 2019 and Subscription Edition","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-58644"],"tags":["microsoft","sharepoint","windows","remote-code-execution","actively-exploited"],"affected":["Microsoft SharePoint Enterprise Server 2016 before 16.0.5556.1005; Microsoft states the same update also applies to SharePoint Server 2016","Microsoft SharePoint Server 2019 before 16.0.10417.20153","Microsoft SharePoint Server Subscription Edition before 16.0.19725.20384"],"fixed":["Microsoft SharePoint Server 2016: 16.0.5556.1005 (KB5002880)","Microsoft SharePoint Server 2019: 16.0.10417.20153 (KB5002874)","Microsoft SharePoint Server Subscription Edition: 16.0.19725.20384 (KB5002873)"],"matches":[],"sources":[{"kind":"advisory","title":"Microsoft SharePoint Remote Code Execution Vulnerability — CVE-2026-58644","url":"https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-58644.json","by":"Microsoft","date":"2026-07-15"},{"kind":"advisory","title":"SharePoint Server 2016 security update: June 9, 2026 (KB5002880)","url":"https://support.microsoft.com/help/5002880","by":"Microsoft","date":"2026-06-09"},{"kind":"advisory","title":"SharePoint Server 2019 security update: June 9, 2026 (KB5002874)","url":"https://support.microsoft.com/help/5002874","by":"Microsoft","date":"2026-06-09"},{"kind":"advisory","title":"SharePoint Server Subscription Edition security update: June 9, 2026 (KB5002873)","url":"https://support.microsoft.com/help/5002873","by":"Microsoft","date":"2026-06-09"},{"kind":"research","title":"CVE-2026-58644: Microsoft SharePoint Server Unauthenticated Remote Code Execution Vulnerability Exploited in the Wild","url":"https://www.rapid7.com/blog/post/etr-cve-2026-58644-microsoft-sharepoint-server-unauthenticated-remote-code-execution-vulnerability-exploited-in-the-wild/","by":"Rapid7","date":"2026-07-23"},{"kind":"advisory","title":"AL26-017 — Critical vulnerabilities impacting Microsoft SharePoint Server","url":"https://www.cyber.gc.ca/en/alerts-advisories/al26-017-critical-vulnerabilities-impacting-microsoft-sharepoint-server-cve-2026-56164-cve-2026-55040-cve-2026-58644?wbdisable=true","by":"Canadian Centre for Cyber Security","date":"2026-07-15"}],"started":"2026-07-14","closed":"2026-07-23","created":"2026-11-03T22:20:47.603Z","updated":"2026-11-03T22:20:47.603Z","cve_notes":[{"cve":"CVE-2026-58644","name":"Untrusted-data deserialisation in SharePoint Server","what":"SharePoint Server mishandles untrusted data while converting it into software objects, allowing a remote attacker to run code on the server.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-07-23","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Rapid7's updated guidance recommended installing all July SharePoint security updates, verifying installation across every server and checking security detections for attempted exploitation.","url":"https://www.rapid7.com/blog/post/etr-cve-2026-58644-microsoft-sharepoint-server-unauthenticated-remote-code-execution-vulnerability-exploited-in-the-wild/","by":"Rapid7","patch":null},{"at":"2026-07-16","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-58644 to its Known Exploited Vulnerabilities catalogue, as documented by Rapid7.","url":"https://www.rapid7.com/blog/post/etr-cve-2026-58644-microsoft-sharepoint-server-unauthenticated-remote-code-execution-vulnerability-exploited-in-the-wild/","by":"Rapid7","patch":null},{"at":"2026-07-15","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Microsoft corrected the advisory's exploitation flag, exploitability assessment and CVSS vector. The revised advisory confirms exploitation and rates the flaw critical, with a CVSS score of 9.8.","url":"https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-58644.json","by":"Microsoft","patch":null},{"at":"2026-07-14","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Microsoft published CVE-2026-58644 and explained that its fix had been released but omitted from June's vulnerability announcements. Its advisory identifies fixed builds for SharePoint Server 2016, 2019 and Subscription Edition.","url":"https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-58644.json","by":"Microsoft","patch":null},{"at":"2026-06-09","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Microsoft released KB5002873 for SharePoint Server Subscription Edition, build 16.0.19725.20384. Microsoft later identified this June update as a fix for CVE-2026-58644.","url":"https://support.microsoft.com/help/5002873","by":"Microsoft","patch":"patched"}],"url":"https://hard.fyi/live/sharepoint-deserialization-exploited-jul-2026/","json":"https://hard.fyi/api/live?id=sharepoint-deserialization-exploited-jul-2026"}