# CVE-2026-58644: Microsoft SharePoint Server Unauthenticated Remote Code Execution Exploited in the Wild

> A critical deserialization-of-untrusted-data flaw (CWE-502, CVSS 9.8) in on-premises Microsoft SharePoint Enterprise Server 2016, Server 2019, and Server Subscription Edition allows an unauthenticated network attacker to execute arbitrary code via the ToolPane/SignOut request-handling path. Microsoft patched it on July 14, 2026 and, after confirming in-the-wild exploitation, CISA added it to the Known Exploited Vulnerabilities catalog on July 16, 2026 with a federal remediation deadline of July 19, 2026.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-07-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1460
- **ID:** TL-2026-1460
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-58644, CVE-2026-32201, CVE-2026-45659, CVE-2026-56164

## Description

CVE-2026-58644 is a critical remote code execution vulnerability in Microsoft SharePoint Server arising from deserialization of untrusted data (CWE-502). The flaw is reached through SharePoint's request-processing pipeline: a crafted, malicious serialized .NET payload delivered to an internet-facing SharePoint endpoint is deserialized without adequate validation, allowing the attacker to instantiate arbitrary objects and achieve code execution in the context of the SharePoint application pool (typically NETWORK SERVICE/SYSTEM-adjacent privilege). Microsoft's own Antimalware Scan Interface (AMSI) detection signatures for this flaw — Exploit:Script/SuspSignoutReqBody.A (malicious SignOut.aspx request-body content, SharePoint Subscription Edition only) and Exploit:Script/ToolPaneAuthBypass.A / Exploit:Script/ToolPaneAuthBypass.C (malicious request headers targeting the ToolPane.aspx web-part endpoint, covering 2016/2019/Subscription Edition) — indicate the exploit chain abuses the SignOut and ToolPane request paths, the same endpoint family exploited in 2025's widely reported "ToolShell" SharePoint attack chain (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771). CISA's July 14, 2026 hardening alert states that threat actors chaining this and related 2026 SharePoint vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164) are stealing IIS machine keys and performing deserialization techniques to gain persistence and deploy malware on compromised farms — machine-key theft is the same persistence primitive used in the 2025 ToolShell campaign to forge __VIEWSTATE / authentication payloads that survive a simple patch. No public IOCs (IPs, domains, hashes) were disclosed in the initial Rapid7 or CISA reporting; detection is signature/behavior-based via AMSI, WAF rules, and post-compromise artifact review (web shells, unexpected IIS worker-process children, rotated machine keys). Microsoft shipped fixes for all three affected product lines on July 14, 2026 (KB5002653 for SharePoint 2016, KB5002654 for SharePoint 2019, KB5002655 for Subscription Edition); Microsoft subsequently revised its advisory to confirm active exploitation had occurred prior to patch availability, prompting CISA's KEV addition two days later under Binding Operational Directive 26-04.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1685 Disable or Modify Tools
- T1606 Forge Web Credentials
- T1140 Deobfuscate/Decode Files or Information
- T1552 Unsecured Credentials
- T1518 Software Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1565 Data Manipulation

## Sources

- [ETR: CVE-2026-58644 - Microsoft SharePoint Server Unauthenticated Remote Code Execution Vulnerability Exploited in the Wild](https://www.rapid7.com/blog/post/etr-cve-2026-58644-microsoft-sharepoint-server-unauthenticated-remote-code-execution-vulnerability-exploited-in-the-wild)
- [CVE-2026-58644 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-58644)
- [Microsoft Security Response Center - CVE-2026-58644](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-58644](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644)
- [CISA Urges SharePoint Hardening After New Exploitations](https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations)
- [CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV](https://thehackernews.com/2026/07/cisa-adds-exploited-sharepoint-rce-zero.html)
- [Fresh SharePoint Vulnerability Exploited Soon After Disclosure](https://www.securityweek.com/fresh-sharepoint-vulnerability-exploited-soon-after-disclosure/)
- [Microsoft SharePoint Server, Deserialization Remote Code Execution, CVE-2026-58644 (CRITICAL)](https://dailycve.com/microsoft-sharepoint-server-deserialization-remote-code-execution-cve-2026-58644-critical-dc-jul2026-1018/)
- [BOD 26-04: Prioritizing Security Updates Based on Risk](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk)
- [BOD 26-04 Implementation Guidance: Prioritizing Security Updates Based on Risk](https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1460