CVE-2026-58644: Microsoft SharePoint Server Unauthenticated Remote Code Execution Exploited in the Wild
CVE-2026-58644 (TL-2026-1460) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-17. It has no confirmed attribution, affects Microsoft SharePoint Enterprise Server 2016, references 1 CVE (CVE-2026-58644), maps to 17 MITRE ATT&CK techniques (T1005, T1041, T1059), and is covered by 9 detection rules and 17 indicators of compromise.
Key facts for TL-2026-1460
- Threat ID
- TL-2026-1460
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-17
- Last reviewed
- 2026-07-17
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, education, technology, manufacturing, energy, legal
- Target regions
- North America, Europe, Asia Pacific, Global
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in CVE-2026-58644
Malware and tooling: AMSI (Antimalware Scan Interface)
A critical deserialization-of-untrusted-data flaw (CWE-502, CVSS 9.8) in on-premises Microsoft SharePoint Enterprise Server 2016, Server 2019, and Server Subscription Edition allows an unauthenticated network attacker to execute arbitrary code via the ToolPane/SignOut request-handling path. Microsoft patched it on July 14, 2026 and, after confirming in-the-wild exploitation, CISA added it to the Known Exploited Vulnerabilities catalog on July 16, 2026 with a federal remediation deadline of July 19, 2026.
How CVE-2026-58644 works
CVE-2026-58644 is a critical remote code execution vulnerability in Microsoft SharePoint Server arising from deserialization of untrusted data (CWE-502). The flaw is reached through SharePoint's request-processing pipeline: a crafted, malicious serialized .NET payload delivered to an internet-facing SharePoint endpoint is deserialized without adequate validation, allowing the attacker to instantiate arbitrary objects and achieve code execution in the context of the SharePoint application pool (typically NETWORK SERVICE/SYSTEM-adjacent privilege). Microsoft's own Antimalware Scan Interface (AMSI) detection signatures for this flaw — Exploit:Script/SuspSignoutReqBody.A (malicious SignOut.aspx request-body content, SharePoint Subscription Edition only) and Exploit:Script/ToolPaneAuthBypass.A / Exploit:Script/ToolPaneAuthBypass.C (malicious request headers targeting the ToolPane.aspx web-part endpoint, covering 2016/2019/Subscription Edition) — indicate the exploit chain abuses the SignOut and ToolPane request paths, the same endpoint family exploited in 2025's widely reported "ToolShell" SharePoint attack chain (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771). CISA's July 14, 2026 hardening alert states that threat actors chaining this and related 2026 SharePoint vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164) are stealing IIS machine keys and performing deserialization techniques to gain persistence and deploy malware on compromised farms — machine-key theft is the same persistence primitive used in the 2025 ToolShell campaign to forge __VIEWSTATE / authentication payloads that survive a simple patch. No public IOCs (IPs, domains, hashes) were disclosed in the initial Rapid7 or CISA reporting; detection is signature/behavior-based via AMSI, WAF rules, and post-compromise artifact review (web shells, unexpected IIS worker-process children, rotated machine keys). Microsoft shipped fixes for all three affected product lines on July 14, 2026 (KB5002653 for SharePoint 2016, KB5002654 for SharePoint 2019, KB5002655 for Subscription Edition); Microsoft subsequently revised its advisory to confirm active exploitation had occurred prior to patch availability, prompting CISA's KEV addition two days later under Binding Operational Directive 26-04.
MITRE ATT&CK techniques used in TL-2026-1460
Collection
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol
Defense Evasion
T1140 Deobfuscate/Decode Files or Information
Initial Access
T1190 Exploit Public-Facing Application
Lateral Movement
T1210 Exploitation of Remote Services
Persistence
T1505 Server Software Component
Discovery
Credential Access
Impact
Resource Development
Reconnaissance
credential-access
defense-impairment
Affected products and versions in CVE-2026-58644
- Microsoft — SharePoint Enterprise Server 2016
Vulnerable versions: < 16.0.5556.1005
Fixed in: 16.0.5556.1005 (KB5002653) - Microsoft — SharePoint Server 2019
Vulnerable versions: < 16.0.10417.20153
Fixed in: 16.0.10417.20153 (KB5002654) - Microsoft — SharePoint Server Subscription Edition
Vulnerable versions: < 16.0.19725.20384
Fixed in: 16.0.19725.20384 (KB5002655)
Remediation for CVE-2026-58644
Patches
- KB5002653 — Microsoft SharePoint Enterprise Server 2016 (fixed build 16.0.5556.1005)
- KB5002654 — Microsoft SharePoint Server 2019 (fixed build 16.0.10417.20153)
- KB5002655 — Microsoft SharePoint Server Subscription Edition (fixed build 16.0.19725.20384)
Immediate actions
- Apply Microsoft's July 14, 2026 security updates: KB5002653 (SharePoint Server 2016), KB5002654 (SharePoint Server 2019), KB5002655 (SharePoint Server Subscription Edition)
- Rotate IIS machine keys on all SharePoint farm servers post-patch, since pre-patch key theft persists across an unrotated patch
- Enable AMSI integration for SharePoint web applications and confirm Exploit:Script/SuspSignoutReqBody.A and Exploit:Script/ToolPaneAuthBypass.A/.C signatures are active
- Scan SharePoint web servers for web-shell and intrusion artifacts introduced prior to patching
- Block or restrict external/internet access to SharePoint Central Administration
Workarounds
- Where immediate patching is not possible, block internet exposure of SharePoint Server and restrict access via VPN/firewall allowlisting
- Enable AMSI-based detection as a compensating control ahead of patch deployment
Longer-term hardening
- Restrict SharePoint farm and database server communications to only required systems and ports
- Deploy centralized logging/telemetry for IIS and SharePoint ULS logs to support exploitation detection and retrospective hunting
- Avoid exposing on-premises SharePoint Server directly to the internet; front internet-facing deployments with a reverse proxy/WAF enforcing SharePoint-specific rules
- Review Microsoft's SharePoint Server security-hardening guidance and adopt periodic machine-key rotation as standard operating procedure
CVEs associated with CVE-2026-58644
Weaknesses (CWE) in CVE-2026-58644
CWE-502
Timeline of CVE-2026-58644
- The 2025 'ToolShell' SharePoint exploitation chain (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) targeting the same ToolPane.aspx/SignOut.aspx endpoint family and IIS machine-key-theft persistence technique establishes the precedent later reused by attackers against CVE-2026-58644.
- Microsoft patches related SharePoint RCE flaw CVE-2026-45659, part of the same deserialization/ToolShell-family vulnerability lineage later chained by attackers alongside CVE-2026-58644.
- CISA publishes an alert urging SharePoint hardening in response to new exploitation activity, citing IIS machine-key theft and deserialization techniques used for persistence and malware deployment across CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644.
- Microsoft's July 2026 Patch Tuesday ships fixes for CVE-2026-58644 across SharePoint Enterprise Server 2016 (KB5002653), Server 2019 (KB5002654), and Subscription Edition (KB5002655).
- Microsoft revises its security advisory for CVE-2026-58644 to confirm evidence of exploitation in the wild prior to patch availability.
- CISA adds CVE-2026-58644 to the Known Exploited Vulnerabilities (KEV) catalog, setting a remediation due date of 2026-07-19 for Federal Civilian Executive Branch agencies under BOD 26-04.
- Rapid7 publishes an Emerging Threat Response (ETR) analysis of CVE-2026-58644, detailing the deserialization vulnerability, affected products, and Microsoft's AMSI detection signatures.
- CISA's BOD 26-04 remediation deadline for Federal Civilian Executive Branch agencies to patch or mitigate CVE-2026-58644 on internet-facing SharePoint Server instances.
Sources cited for CVE-2026-58644
- ETR: CVE-2026-58644 - Microsoft SharePoint Server Unauthenticated Remote Code Execution Vulnerability Exploited in the Wild
- CVE-2026-58644 Detail
- Microsoft Security Response Center - CVE-2026-58644
- CISA Known Exploited Vulnerabilities Catalog - CVE-2026-58644
- CISA Urges SharePoint Hardening After New Exploitations
- CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
- Fresh SharePoint Vulnerability Exploited Soon After Disclosure
- Microsoft SharePoint Server, Deserialization Remote Code Execution, CVE-2026-58644 (CRITICAL)
- BOD 26-04: Prioritizing Security Updates Based on Risk
- BOD 26-04 Implementation Guidance: Prioritizing Security Updates Based on Risk
Threats related to CVE-2026-58644
- Microsoft July 2026 Patch Tuesday: 570 Vulnerabilities Fixed, Including 2 Actively Exploited Zero-Days (CVE-2026-56164, CVE-2026-56155)
- Microsoft July 2026 Patch Tuesday: 569 CVEs, Two Actively Exploited Zero-Days (CVE-2026-56155 AD FS EoP, CVE-2026-56164 SharePoint EoP)
- Microsoft July 2026 Patch Tuesday: Record 622 CVEs Include Two Actively Exploited Zero-Days in AD FS (CVE-2026-56155) and SharePoint Server (CVE-2026-56164)
- Actively Exploited SharePoint Server Elevation of Privilege Flaw (CVE-2026-56164) Patched Alongside Critical RCE Pair in July 2026 Patch Tuesday
- Microsoft July 2026 Patch Tuesday: Two Actively Exploited Zero-Days in AD FS and SharePoint (CVE-2026-56155, CVE-2026-56164)
- Microsoft July 2026 Patch Tuesday: 570 Flaws Fixed, 3 Zero-Days Including AD FS and SharePoint Privilege Escalation
Detection coverage for TL-2026-1460
As of 2026-07-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1460 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.