# CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV Catalog

> CISA added CVE-2026-58644, a critical (CVSS 9.8) deserialization-of-untrusted-data vulnerability in on-premises Microsoft SharePoint Server, to its Known Exploited Vulnerabilities catalog on 2026-07-16 after confirming active in-the-wild exploitation that began before patches shipped. Attackers are chaining CVE-2026-58644 with three other recently-patched SharePoint flaws (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164) to gain unauthenticated remote code execution, steal IIS machine keys, and forge signed ViewState objects for persistent backdoor access; federal agencies must remediate by 2026-07-19.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-07-18T07:34:38.813Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1434
- **ID:** TL-2026-1434
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-58644, CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-55040

## Description

CVE-2026-58644 is a critical deserialization-of-untrusted-data vulnerability (CWE-502) in Microsoft SharePoint Server (Subscription Edition, 2019, and Enterprise Server 2016). SharePoint's handling of serialized .NET objects during network communication fails to validate untrusted input before reconstruction; attackers craft malicious serialized payloads (e.g. objects such as System.Windows.Data.ObjectDataProvider used in classic .NET deserialization gadget chains) that SharePoint deserializes and executes without requiring authentication or user interaction. The flaw is reachable directly over the network (AV:N, AC:L, PR:N, UI:N), giving a full CVSS 3.1 base score of 9.8 with complete compromise of confidentiality, integrity, and availability.

Microsoft shipped July 2026 Patch Tuesday fixes on 2026-07-14 (KB5002653 for SharePoint 2016, KB5002654 for SharePoint 2019, KB5002655 for Subscription Edition) with an initial 'Exploitation More Likely' label; by 2026-07-15 Microsoft had updated the advisory to confirm exploitation detected in the wild, and CISA added the CVE to KEV on 2026-07-16 with a federal remediation deadline of 2026-07-19 under BOD 26-04.

The active campaign does not rely on CVE-2026-58644 alone. CISA's accompanying guidance describes attackers chaining it with previously-patched SharePoint vulnerabilities — CVE-2026-32201 (improper input validation / spoofing, KEV-added 2026-04-14), CVE-2026-45659 (deserialization of untrusted data / RCE, KEV-added 2026-07-01, out-of-band patched in May), and CVE-2026-56164 (missing authentication for a critical function / unauthenticated privilege escalation, KEV-added 2026-07-14) — to establish a complete attack path: unauthenticated initial access and privilege escalation via CVE-2026-56164, arbitrary code execution via the deserialization primitives in CVE-2026-58644/CVE-2026-45659, and machine-level trust abuse via the spoofing weakness in CVE-2026-32201. A related, not-yet-actively-exploited authentication bypass (CVE-2026-55040, CVSS 9.1) has also been demonstrated by researchers as chainable with a separate RCE bug to reach unauthenticated code execution, and is scheduled for patching in August 2026.

Post-exploitation, attackers pivot from code execution to extracting the server's ASP.NET/IIS Machine Key — either read in plaintext from web.config files (common in SharePoint farm configurations that synchronize a shared key across nodes) or retrieved from the Windows Registry when SharePoint auto-generates the key. Once the Machine Key is exfiltrated, attackers use the public tool ysoserial.net to craft malicious ViewState payloads embedding RCE gadgets; because these payloads are cryptographically signed with the legitimate stolen Machine Key, IIS trusts and deserializes them on any ASPX page in the application. This grants a durable, patch-resistant backdoor: the forged ViewState technique survives server reboots and does not depend on the original vulnerability remaining unpatched, since the attacker already possesses the trust material needed to sign new payloads.

This mechanical fingerprint — chained SharePoint deserialization/auth-bypass bugs leading to IIS Machine Key theft and forged ViewState persistence — closely mirrors the July 2025 'ToolShell' SharePoint campaign (CVE-2025-53770/53771) attributed to Chinese state-nexus actors Linen Typhoon and Violet Typhoon plus ransomware affiliate Storm-2603, which hit finance, healthcare, government, and energy targets at scale. No specific attribution has yet been confirmed for the current 2026 campaign by CISA, Microsoft, or the cited reporting; the ToolShell precedent is documented here as relevant historical context for detection/hunting priority, not as a confirmed attribution.

CISA and Microsoft mitigation guidance for defenders: apply the July 2026 patches immediately (KB5002653/KB5002654/KB5002655), enable AMSI integration with full request-body scanning for every SharePoint web application, hunt for unauthorized administrator activity, unexpected web shells, suspicious worker-process children, and modifications to SharePoint application files, rotate IIS Machine Keys after any suspected compromise (patching alone does not invalidate an already-stolen key), monitor Windows Application event logs for Event ID 4009 (ViewState MAC/verification failures — a strong indicator of forged-ViewState exploitation attempts), restrict access to SharePoint Central Administration, and avoid direct internet exposure of on-premises SharePoint front-ends.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1505.003 Server Software Component: Web Shell
- T1606 Forge Web Credentials
- T1068 Exploitation for Privilege Escalation
- T1078 Valid Accounts
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1550 Use Alternate Authentication Material
- T1552.001 Unsecured Credentials: Credentials In Files
- T1528 Steal Application Access Token
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1565 Data Manipulation
- T1588.002 Obtain Capabilities: Tool
- T1595.002 Active Scanning: Vulnerability Scanning
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1003.001 OS Credential Dumping: LSASS Memory
- T1016 System Network Configuration Discovery
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1210 Exploitation of Remote Services
- T1105 Ingress Tool Transfer
- T1486 Data Encrypted for Impact
- T1484.001 Domain or Tenant Policy Modification: Group Policy Modification

## Sources

- [CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV](https://thehackernews.com/2026/07/cisa-adds-exploited-sharepoint-rce-zero.html)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [NVD - CVE-2026-58644](https://nvd.nist.gov/vuln/detail/CVE-2026-58644)
- [NVD - CVE-2026-32201](https://nvd.nist.gov/vuln/detail/CVE-2026-32201)
- [Microsoft Security Response Center - CVE-2026-58644](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644)
- [Microsoft Security Response Center - CVE-2026-32201](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201)
- [CISA Urges SharePoint Hardening After New Exploitations](https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations)
- [CISA sounds alarm over trio of exploited SharePoint flaws](https://www.theregister.com/security/2026/07/15/cisa-sounds-alarm-over-trio-of-exploited-sharepoint-flaws/5271814)
- [Hackers Can Steal IIS Machine Keys by Exploiting SharePoint Deserialization Vulnerability](https://cybersecuritynews.com/iis-machine-keys/)
- [Microsoft July 2026 Patch Tuesday Addresses Exploited SharePoint Vulnerabilities](https://fieldeffect.com/blog/microsoft-patch-addresses-sharepoint-vulnerabilities)
- [Microsoft SharePoint Server Deserialization RCE CVE-2026-58644 (Critical)](https://dailycve.com/microsoft-sharepoint-server-deserialization-remote-code-execution-cve-2026-58644-critical-dc-jul2026-1018/)
- [CISA Urges Immediate Patching of Exploited SharePoint Vulnerabilities](https://www.securityweek.com/cisa-urges-immediate-patching-of-exploited-sharepoint-vulnerabilities/)
- [SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation](https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1434