Skip to main content
Change Risk Intel
CVE tracker

CVE-2026-58644 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.

CVSS
9.8 (Critical)
KEV status
CISA KEV — Listed
First seen (CISA KEV)
Recommended change window
Emergency patch — deploy within 72 hours of the MSRC advisory; treat as after-hours change with a rollback snapshot.
Vendor advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644
Affected products
Microsoft SharePoint

Why this one matters to a CAB

SharePoint on-premises has been on CISA’s most-frequently-added-vendor list for years, and July 2026 added another deserialization bug that turns any anonymous HTTP request into potential remote code execution. The pattern is the familiar System.Runtime.Serialization gadget chain — the same class of bug behind the ToolShell activity earlier in the year. Because SharePoint typically runs as a service account with Kerberos delegation privileges, a foothold here rarely stays scoped to the web front end.

Defender’s angle

  • Attack surface: any SharePoint 2016 / 2019 / SE farm reachable on port 443. If you rely on a reverse proxy or WAF, confirm the proxy is not stripping request framing that the SharePoint OWSTIMER or STS endpoints use to detect malformed payloads.
  • Detection: look for w3wp.exe spawning cmd.exe, powershell.exe, or any .NET reflection process (InstallUtil.exe, regsvr32.exe) under the SharePoint app-pool identity. Microsoft Defender for Endpoint’s SharePoint attack surface reduction rule (d1e49aac-8f56-4280-b9ba-993a6d77406c) will catch the common variants once enabled in block mode.
  • Isolation-first mitigation: if you cannot patch inside the CISA window, disable the SharePoint Web Application until the update is applied. Stopping IIS is not sufficient — the timer service is also in scope on some builds.

What to bring to CAB

A single-page change record that names the specific SharePoint build number pre- and post-patch, the AAM (Alternate Access Mappings) list that will briefly return 503s during the app-pool recycle, and the service-account rotation plan if any indicator of compromise is found during the pre-patch triage. Do not schedule this into a Wednesday afternoon window shared with an unrelated release train.

Sources

This page summarizes publicly available information from CISA KEV, NVD, and the listed vendor advisory. Change Risk Intel does not publish exploit walkthroughs. Verify with your vendor before scheduling any change window.