CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV

The Critical SharePoint Zero-Day

The vulnerability, identified as CVE-2026-58644, carries a CVSS score of 9.8, indicating its severe impact. Microsoft describes it as a critical deserialization of untrusted data flaw that enables an unauthorized attacker, authenticated as at least a Site Owner, to inject and execute arbitrary code remotely on a SharePoint Server. This means that once an attacker gains a basic level of access, they can leverage this flaw to take full control of the server.

Microsoft's advisory explicitly states that the vulnerability is remotely exploitable over the internet, making it a high-risk target for threat actors. A key concern highlighted by Microsoft is the low attack complexity associated with CVE-2026-58644. Attackers do not require extensive prior knowledge of the system, and they can achieve repeatable success with their payloads against the vulnerable component. This ease of exploitation significantly lowers the bar for malicious actors, increasing the likelihood of widespread attacks. The flaw impacts multiple versions of SharePoint Server, including Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016, affecting a broad range of enterprise deployments.

CISA's Urgent Mandate and Broader Context

CISA's decision to add CVE-2026-58644 to its Known Exploited Vulnerabilities (KEV) catalog underscores the severity and active threat posed by this flaw. The KEV catalog is reserved for vulnerabilities that have been confirmed to be exploited in the wild, signaling an immediate and critical risk. Federal Civilian Executive Branch (FCEB) agencies are now required to apply the necessary patches by July 19, 2026, a tight deadline reflecting the urgency of the situation. This directive aims to protect critical government infrastructure from ongoing attacks.

The agency's warning extends beyond just CVE-2026-58644, encompassing active exploitation of several other SharePoint Server vulnerabilities, including CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164. These combined flaws enable threat actors to gain unauthorized access, establish remote code execution, and perform post-exploitation activities such as stealing Internet Information Services (IIS) machine keys and deploying malware. This indicates a coordinated effort by attackers to compromise SharePoint environments, leveraging multiple weaknesses for persistence and broader impact.

Essential Hardening Measures

To counter these threats, CISA has provided a comprehensive set of hardening measures. The primary recommendation is to apply the latest patches and security updates from Microsoft promptly and verify their successful installation, emphasizing the need to shorten patching cycles. Beyond patching, CISA advises enabling Antimalware Scan Interface (AMSI) integration for all SharePoint web applications, which helps detect and block malicious activity.

Furthermore, agencies are urged to scan for and remove intrusion artifacts, including machine key harvesting tools, before rotating IIS machine keys to prevent their theft. Establishing tailored logging mechanisms is crucial for detecting and monitoring exploitation activities effectively. Finally, CISA recommends avoiding direct exposure of SharePoint Servers to the internet unless absolutely necessary, blocking external access to SharePoint Central Administration, restricting farm and database communications to essential systems, and reviewing Microsoft's detailed security-hardening guidance for role-specific configurations. These measures collectively aim to create a more resilient SharePoint environment against sophisticated attacks.