CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV Catalog — Threadlinqs Intelligence
As of 2026-07-18, CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV Catalog is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-1434 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: VULNERABILITY
Updated: 2026-07-18 · revalidated 1× · latest source
CISA added CVE-2026-58644, a critical (CVSS 9.8) deserialization-of-untrusted-data vulnerability in on-premises Microsoft SharePoint Server, to its Known Exploited Vulnerabilities catalog on
CVE-2026-58644 is a critical deserialization-of-untrusted-data vulnerability (CWE-502) in Microsoft SharePoint Server (Subscription Edition, 2019, and Enterprise Server 2016). SharePoint's handling of serialized .NET objects during network communication fails to validate untrusted input before reconstruction; attackers craft malicious serialized payloads (e.g. objects such as System.Windows.Data.ObjectDataProvider used in classic .NET deserialization gadget chains) that SharePoint deserializes and executes without requiring authentication or user interaction. The flaw is reachable directly over the network (AV:N, AC:L, PR:N, UI:N), giving a full CVSS 3.1 base score of 9.8 with complete compromise of confidentiality, integrity, and availability.
Microsoft shipped July 2026 Patch Tuesday fixes on 2026-07-14 (KB5002653 for SharePoint 2016, KB5002654 for SharePoint 2019, KB5002655 for Subscription Edition) with an initial 'Exploitation More Likely' label; by 2026-07-15 Microsoft had updated the advisory to confirm exploitation detected in the wild, and CISA added the CVE to KEV on 2026-07-16 with a federal remediation deadline of 2026-07-19 under BOD 26-04.
The active campaign does not rely on CVE-2026-58644 alone. CISA's accompanying guidance describes attackers chaining it with previously-patched SharePoint vulnerabilities — CVE-2026-32201 (improper input validation / spoofing, KEV-added 2026-04-14), CVE-2026-45659 (deserialization of untrusted data / RCE, KEV-added 2026-07-01, out-of-band patched in May), and CVE-2026-56164 (missing authentication for a critical function / unauthenticated privilege escalation, KEV-added 2026-07-14) — to establish a complete attack path: unauthenticated initial access and privilege escalation via CVE-2026-56164, arbitrary code execution via the deserialization primitives in CVE-2026-58644/CVE-2026-45659, and machine-level trust abuse via the spoofing weakness in CVE-2026-32201. A related, not-yet-actively-exploited authentication bypass (CVE-2026-55040, CVSS 9.1) has also been demonstrated by researchers as chainable with a separate RCE bug to reach unauthenticated code execution, and is scheduled for patching in August 2026.
Post-exploitation, attackers pivot from code execution to extracting the server's ASP.NET/IIS Machine Key — either read in plaintext from web.config files (common in SharePoint farm configurations that synchronize a shared key across nodes) or retrieved from the Windows Registry when SharePoint auto-generates the key. Once the Machine Key is exfiltrated, attackers use the public tool ysoserial.net to craft malicious ViewState payloads embedding RCE gadgets; because these payloads are cryptographically signed with the legitimate stolen Machine Key, IIS trusts and deserializes them on any ASPX page in the application. This grants a durable, patch-resistant backdoor: the forged ViewState technique survives server reboots and does not depend on the original vulnerability remaining unpatched, since the attacker already possesses the trust material needed to sign new payloads.
This mechanical fingerprint — chained SharePoint deserialization/auth-bypass bugs leading to IIS Machine Key theft and forged ViewState persistence — closely mirrors the July 2025 'ToolShell' SharePoint campaign (CVE-2025-53770/53771) attributed to Chinese state-nexus actors Linen Typhoon and Violet Typhoon plus ransomware affiliate Storm-2603, which hit finance, healthcare, government, and energy targets at scale. No specific attribution has yet been confirmed for the current 2026 campaign by CISA, Microsoft, or the cited reporting; the ToolShell precedent is documented here as relevant historical context for detection/hunting priority, not as a confirmed attribution.
CISA and Microsoft mitigation guidance for defenders: apply the July 2026 patches immediately (KB5002653/KB5002654/KB5002655), enable AMSI integration with full request-body scanning for every SharePoint web application, hunt for unautho
Weaknesses (CWE)
CWE-502, CWE-20, CWE-306, CWE-290
Target sectors: government administration, finance, health, energy, technology, education
Target regions: North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-58644, CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-55040, T1190, T1203, T1059.001, T1505.003, T1606, T1068, T1078, T1140, T1562.001, T1550