CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV Catalog
CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 (TL-2026-1434), also tracked as SharePoint ToolShell-pattern 2026 KEV chain, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-17 and last reviewed 2026-07-18. It has no confirmed attribution, affects Microsoft SharePoint Enterprise Server 2016, references 5 CVEs (CVE-2026-58644, CVE-2026-32201, CVE-2026-45659), maps to 28 MITRE ATT&CK techniques (T1003.001, T1005, T1016), and is covered by 9 detection rules and 23 indicators of compromise.
Key facts for TL-2026-1434
- Threat ID
- TL-2026-1434
- Also known as
- SharePoint ToolShell-pattern 2026 KEV chain
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-17
- Last reviewed
- 2026-07-18
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, energy, technology, education
- Target regions
- North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 23
- Updates
- 2026-07-18 · revalidated 1× · latest source
Malware and tooling in CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644
Malware and tooling: ysoserial.net
CISA added CVE-2026-58644, a critical (CVSS 9.8) deserialization-of-untrusted-data vulnerability in on-premises Microsoft SharePoint Server, to its Known Exploited Vulnerabilities catalog on 2026-07-16 after confirming active in-the-wild exploitation that began before patches shipped. Attackers are chaining CVE-2026-58644 with three other recently-patched SharePoint flaws (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164) to gain unauthenticated remote code execution, steal IIS machine keys, and forge signed ViewState objects for persistent backdoor access; federal agencies must remediate by 2026-07-19.
How CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 works
CVE-2026-58644 is a critical deserialization-of-untrusted-data vulnerability (CWE-502) in Microsoft SharePoint Server (Subscription Edition, 2019, and Enterprise Server 2016). SharePoint's handling of serialized .NET objects during network communication fails to validate untrusted input before reconstruction; attackers craft malicious serialized payloads (e.g. objects such as System.Windows.Data.ObjectDataProvider used in classic .NET deserialization gadget chains) that SharePoint deserializes and executes without requiring authentication or user interaction. The flaw is reachable directly over the network (AV:N, AC:L, PR:N, UI:N), giving a full CVSS 3.1 base score of 9.8 with complete compromise of confidentiality, integrity, and availability.
Microsoft shipped July 2026 Patch Tuesday fixes on 2026-07-14 (KB5002653 for SharePoint 2016, KB5002654 for SharePoint 2019, KB5002655 for Subscription Edition) with an initial 'Exploitation More Likely' label; by 2026-07-15 Microsoft had updated the advisory to confirm exploitation detected in the wild, and CISA added the CVE to KEV on 2026-07-16 with a federal remediation deadline of 2026-07-19 under BOD 26-04.
The active campaign does not rely on CVE-2026-58644 alone. CISA's accompanying guidance describes attackers chaining it with previously-patched SharePoint vulnerabilities — CVE-2026-32201 (improper input validation / spoofing, KEV-added 2026-04-14), CVE-2026-45659 (deserialization of untrusted data / RCE, KEV-added 2026-07-01, out-of-band patched in May), and CVE-2026-56164 (missing authentication for a critical function / unauthenticated privilege escalation, KEV-added 2026-07-14) — to establish a complete attack path: unauthenticated initial access and privilege escalation via CVE-2026-56164, arbitrary code execution via the deserialization primitives in CVE-2026-58644/CVE-2026-45659, and machine-level trust abuse via the spoofing weakness in CVE-2026-32201. A related, not-yet-actively-exploited authentication bypass (CVE-2026-55040, CVSS 9.1) has also been demonstrated by researchers as chainable with a separate RCE bug to reach unauthenticated code execution, and is scheduled for patching in August 2026.
Post-exploitation, attackers pivot from code execution to extracting the server's ASP.NET/IIS Machine Key — either read in plaintext from web.config files (common in SharePoint farm configurations that synchronize a shared key across nodes) or retrieved from the Windows Registry when SharePoint auto-generates the key. Once the Machine Key is exfiltrated, attackers use the public tool ysoserial.net to craft malicious ViewState payloads embedding RCE gadgets; because these payloads are cryptographically signed with the legitimate stolen Machine Key, IIS trusts and deserializes them on any ASPX page in the application. This grants a durable, patch-resistant backdoor: the forged ViewState technique survives server reboots and does not depend on the original vulnerability remaining unpatched, since the attacker already possesses the trust material needed to sign new payloads.
This mechanical fingerprint — chained SharePoint deserialization/auth-bypass bugs leading to IIS Machine Key theft and forged ViewState persistence — closely mirrors the July 2025 'ToolShell' SharePoint campaign (CVE-2025-53770/53771) attributed to Chinese state-nexus actors Linen Typhoon and Violet Typhoon plus ransomware affiliate Storm-2603, which hit finance, healthcare, government, and energy targets at scale. No specific attribution has yet been confirmed for the current 2026 campaign by CISA, Microsoft, or the cited reporting; the ToolShell precedent is documented here as relevant historical context for detection/hunting priority, not as a confirmed attribution.
CISA and Microsoft mitigation guidance for defenders: apply the July 2026 patches immediately (KB5002653/KB5002654/KB5002655), enable AMSI integration with full request-body scanning for every SharePoint web application, hunt for unauthorized administrator activity, unexpected web shells, suspicious worker-process children, and modifications to SharePoint application files, rotate IIS Machine Keys after any suspected compromise (patching alone does not invalidate an already-stolen key), monitor Windows Application event logs for Event ID 4009 (ViewState MAC/verification failures — a strong indicator of forged-ViewState exploitation attempts), restrict access to SharePoint Central Administration, and avoid direct internet exposure of on-premises SharePoint front-ends.
MITRE ATT&CK techniques used in TL-2026-1434
Credential Access
T1003.001 OS Credential Dumping: LSASS Memory; T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files
Collection
Discovery
T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin Shares; T1210 Exploitation of Remote Services
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task; T1505.003 Server Software Component: Web Shell
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer
Defense Evasion
T1140 Deobfuscate/Decode Files or Information
Initial Access
T1190 Exploit Public-Facing Application
defense-impairment
T1484.001 Domain or Tenant Policy Modification: Group Policy Modification; T1685 Disable or Modify Tools
Impact
T1486 Data Encrypted for Impact; T1565 Data Manipulation
lateral-movement
T1550 Use Alternate Authentication Material
Resource Development
T1588.002 Obtain Capabilities: Tool
Reconnaissance
T1595.002 Active Scanning: Vulnerability Scanning
credential-access
Affected products and versions in CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644
- Microsoft — SharePoint Enterprise Server 2016
Vulnerable versions: < 16.0.5556.1005
Fixed in: 16.0.5556.1005 (KB5002653) - Microsoft — SharePoint Server 2019
Vulnerable versions: < 16.0.10417.20153
Fixed in: 16.0.10417.20153 (KB5002654) - Microsoft — SharePoint Server Subscription Edition
Vulnerable versions: < 16.0.19725.20384
Fixed in: 16.0.19725.20384 (KB5002655)
Remediation for CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644
Patches
- KB5002653 — SharePoint Enterprise Server 2016 (fixed build 16.0.5556.1005+)
- KB5002654 — SharePoint Server 2019 (fixed build 16.0.10417.20153+)
- KB5002655 — SharePoint Server Subscription Edition (fixed build 16.0.19725.20384+)
- Out-of-band patch for CVE-2026-45659 (issued May 2026)
- April 2026 patch for CVE-2026-32201
Immediate actions
- Apply KB5002653 (SharePoint 2016), KB5002654 (SharePoint 2019), and KB5002655 (Subscription Edition) immediately
- Rotate IIS/ASP.NET Machine Keys on every SharePoint farm node after patching, regardless of confirmed compromise
- Hunt for unauthorized administrator activity, unexpected web shells, and modified SharePoint application files
- Enable AMSI integration with full request-body scanning on every SharePoint web application
- Take internet-facing SharePoint servers offline or place them behind an application-layer proxy/WAF until patched
Workarounds
- If patching is not immediately possible, disable direct internet exposure of the SharePoint front-end and require VPN/reverse-proxy access
- Enforce AMSI + full request-body scanning as a stop-gap detection/prevention layer ahead of patch deployment
- Restrict SharePoint Central Administration to internal management VLANs only
Longer-term hardening
- Restrict access to SharePoint Central Administration to trusted management networks only
- Establish tailored, centralized logging for SharePoint and IIS with alerting on Event ID 4009 (ViewState verification failure)
- Deploy EDR with .NET deserialization / gadget-chain behavioral detection on SharePoint front-end and application servers
- Adopt scheduled/automated Machine Key rotation rather than static long-lived keys
- Segment SharePoint farms from the broader Active Directory environment to limit lateral movement from a compromised front-end
CVEs associated with CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644
CVE-2026-58644, CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-55040
Weaknesses (CWE) in CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644
CWE-502, CWE-20, CWE-306, CWE-290
Timeline of CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644
- CISA adds CVE-2026-32201 (SharePoint spoofing / improper input validation) to KEV following confirmed exploitation; federal due date 2026-04-28.
- Microsoft ships an out-of-band patch for CVE-2026-45659 (SharePoint Server deserialization of untrusted data).
- CISA adds CVE-2026-45659 to KEV after observing active exploitation of the already-patched deserialization flaw.
- CISA adds CVE-2026-56164 (missing authentication for critical function / unauthenticated privilege escalation) to KEV; federal due date 2026-07-17.
- Microsoft's July 2026 Patch Tuesday ships KB5002653/KB5002654/KB5002655 fixing CVE-2026-58644 and CVE-2026-56164; CVE-2026-58644 initially labeled 'Exploitation More Likely'.
- CISA publishes hardening guidance urging organizations to patch, hunt for web shells/unauthorized admin activity, and rotate IIS machine keys.
- Microsoft updates the CVE-2026-58644 advisory to confirm exploitation detected in the wild, chained with the other SharePoint flaws to steal IIS machine keys.
- CISA formally adds CVE-2026-58644 to the KEV catalog with a federal remediation due date of 2026-07-19 under BOD 26-04.
- The Hacker News and other outlets report widely on the KEV addition and the chained SharePoint exploitation campaign, prompting TL-Intel hunt skeleton creation.
- Deadline for FCEB federal agencies to complete remediation of CVE-2026-58644 under Binding Operational Directive (BOD) 26-04's compressed 3-day mandate.
Update history for TL-2026-1434
- 2026-07-18 — CVE-2026-58644: Critical SharePoint Deserialization RCE Exploited in the Wild, Added to CISA KEV: What changed No field escalations. Same CVE/CVSS/severity/status as existing record. The newer report adds ToolShell-lineage post-exploitation detail (webshell filenames, credential-theft/lateral-movement tooling) and additional MITRE techn
Sources cited for CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644
- CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
- CISA Known Exploited Vulnerabilities Catalog
- NVD - CVE-2026-58644
- NVD - CVE-2026-32201
- Microsoft Security Response Center - CVE-2026-58644
- Microsoft Security Response Center - CVE-2026-32201
- CISA Urges SharePoint Hardening After New Exploitations
- CISA sounds alarm over trio of exploited SharePoint flaws
- Hackers Can Steal IIS Machine Keys by Exploiting SharePoint Deserialization Vulnerability
- Microsoft July 2026 Patch Tuesday Addresses Exploited SharePoint Vulnerabilities
- Microsoft SharePoint Server Deserialization RCE CVE-2026-58644 (Critical)
- CISA Urges Immediate Patching of Exploited SharePoint Vulnerabilities
- SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
Threats related to CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644
- CISA Warns of Trio of Actively Exploited SharePoint Server Flaws (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164)
- Microsoft July 2026 Patch Tuesday: Record 622 Flaws Fixed, Two Zero-Days Under Active Exploitation (CVE-2026-56164, CVE-2026-56155)
- Microsoft SharePoint Authenticated RCE via Deserialization of Untrusted Data (CVE-2026-45659)
- CVE-2026-45659: Microsoft SharePoint Deserialization RCE Actively Exploited, Added to CISA KEV
- July 2026 Patch Tuesday: Two Actively Exploited Microsoft Zero-Days (SharePoint EoP CVE-2026-56164, AD FS EoP CVE-2026-56155) Plus SharePoint JWT Auth Bypass CVE-2026-55040
- Actively Exploited SharePoint Server Elevation of Privilege Flaw (CVE-2026-56164) Patched Alongside Critical RCE Pair in July 2026 Patch Tuesday
Detection coverage for TL-2026-1434
As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1434 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.