CVE-2026-58644Active Exploitation(microsoft / sharepoint_server)

CRITICALCVSS 9.8 · CRITICALCISA KEV

Exploitation observed; activity peaked at 39 mentions and remains active

Immediate actions

Patch microsoft sharepoint_server systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

microsoft CVEs Back to dashboard

8.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-07-19. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Patch / fix

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644

Weakness type (CWE)

CWE-502

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

sharepoint_server

Threat summary

Active exploitation appears in 77 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
101 mentions across 20 observed days

What's happening

Active exploitation reported across 77 signals
Exploit tool or code specified in 3 signals
PoC mentioned or linked in 4 signals
Patch or workaround mentioned in 58 signals
Technical details provided in 77 signals
Disclosure: 7 classified signals
Peaked 17d ago at 39 mentions (2026-07-17); latest day: 2
101 total mentions across 20 days

Affected systems

Vendors

microsoft

Products

sharepoint_server

2 versions affected across 1 product

Deep dive

Activity timeline101 mentions / 20d

Signal classification5 categories

Active Exploitation

7372.3%

Patch

1514.9%

Disclosure

76.9%

General

55.0%

Exploit

11.0%

Referenced assets70 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-15	8	Active Exploitation1Disclosure2Exploit1General1Patch3
2026-07-16	7	Active Exploitation4Disclosure1Patch2
2026-07-17	39	Active Exploitation36General1Patch2
2026-07-18	9	Active Exploitation8Patch1
2026-07-19	8	Active Exploitation4Disclosure1Patch3
2026-07-20	6	Active Exploitation5Disclosure1
2026-07-21	3	Patch3
2026-07-22	2	Active Exploitation1Patch1
2026-07-23	1	Disclosure1
2026-07-24	3	Active Exploitation1General2
2026-07-26	1	Active Exploitation1
2026-07-29	1	Active Exploitation1
2026-08-02	1	Active Exploitation1
2026-08-04	3	Active Exploitation3
2026-08-06	1	Active Exploitation1
2026-08-10	2	Active Exploitation1General1
2026-08-12	1	Active Exploitation1
2026-08-13	1	Active Exploitation1
2026-08-14	2	Active Exploitation1Disclosure1
2026-08-17	2	Active Exploitation2

Full discourse20 posts

The Hacker News@TheHackersNews89d
Active Exploitation
Microsoft patched a SharePoint flaw after attackers had already exploited it as a zero-day. CVE-2026-58644 affects every supported on-premises SharePoint version and can lead to remote code execution. CISA has now added it to KEV. https://t.co/qvIXxDM6jW
Post summary
Microsoft patched SharePoint CVE-2026-58644 after it was exploited in the wild; the vulnerability allows remote code execution and has been added to the KEV list.
520162721.6K
2.3M followersView on X
Defused@DefusedCyber86d
Disclosure
🚨 Update to our Jul 17 SharePoint report: we now assess the undocumented deserialization vector on our honeypots as likely CVE-2026-50522. The captured requests carry no authentication material, matching 50522's unauthenticated profile. Microsoft describes the paired CVE-2026-58644 as requiring Site Owner auth, which does not fit unauthenticated traffic. CVE-2026-50522 is currently not known to be exploited in-the-wild. Track SharePoint exploitation live http://console.defusedcyber.com/signup
Post summary
The tweet updates a SharePoint vulnerability assessment, noting that CVE‑2026‑50522 likely involves an unauthenticated deserialization flaw, with no known exploitation, and no patch information provided.
216141118.7K
7.7K followersView on X
Censys@censysio88d
Active Exploitation
🚨 Two critical vulnerabilities in on-premises Microsoft Office SharePoint Server allow RCE without authentication: CVE-2026-58644 and CVE-2026-50522. ▪️ Affected versions: on-premises editions of Microsoft SharePoint Server: SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition ▪️ CVE-2026-58644 marked as exploited ▪️ Patch available. See full advisory for more info: 🔗 https://hubs.ly/Q04pTvsV0
Post summary
Two critical SharePoint Server CVEs allow unauthenticated RCE; CVE‑2026‑58644 is confirmed exploited, and a patch has been released.
19136193.9K
12.6K followersView on X
CISA Cyber@CISACyber89d
Active Exploitation
🛡️We added Fortinet FortiSandbox vulnerabilities CVE-2026-25089 & CVE-2026-39808 and Microsoft SharePoint vulnerability CVE-2026-58644 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/jfzm47JWjo
Post summary
The tweet announces that three CVEs – two Fortinet FortiSandbox and one Microsoft SharePoint – have been added to the KEV catalog, signaling current exploitation, and urges applying mitigations.
61213548.4K
302.1K followersView on X
pdnuclei-bot@pdnuclei_bot61d
Disclosure
🚨 CVE-2026-58644 - critical 🚨 Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE > Microsoft SharePoint Server (2016, 2019, Subscription Edition <= 2026.3.1) contains a... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-58644 @pdnuclei #Nu...
Post summary
The advisory announces a critical RCE vulnerability, CVE-2026-58644, impacting Microsoft SharePoint Server versions 2016, 2019, and Subscription Edition <= 2026.3.1, and provides basic technical details about the flaw.
04033191.5K
1.3K followersView on X
LuemmelSec@theluemmel91d
Exploit
Running SharePoint? There are at least 4 vulns you want to pay attention to: CVE-2026-55040, CVE-2026-52522, CVE-2026-58644, CVE-2026-56164 unauthenticated RCE, exploits available etc. https://www.zerodayinitiative.com/blog/2026/7/14/the-july-2026-security-update-review
Post summary
Four SharePoint CVEs with unauthenticated RCEs are highlighted; the post points to a blog for details and notes that exploits are available, but no active exploitation or patches are mentioned.
27027143.3K
8.5K followersView on X
piyokango@piyokango89d
Active Exploitation
米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。（7/16追加） CVE-2026-25089 Fortinet FortiSandbox OS Command Injection Vulnerability ✅概要・深刻度：緊急 9.8 (CVSS Base) / Fortinet, Inc. (CNA) ・種別：OSコマンドインジェクション (CWE-78) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Fortinet FortiSandbox、FortiSandbox Cloud、FortiSandbox PaaS に存在する OS コマンドインジェクションの脆弱性です。 FortiSandbox の start vnc 機能における JSON 入力処理に問題があり、未認証のリモート攻撃者が細工した HTTP リクエストを送信することで、不正なコマンドを実行できる可能性があります。 ✅ChatGPTによる脆弱性評価・国内影響度：高・悪用難易度：低 ✅CISA 評価・攻撃自動化：自動化は可能・技術的影響：完全制御・BOD 26-04 対処期限（露出あり）：2026年7月19日・BOD 26-04 対処期限（露出なし）：2026年7月30日 ✅攻撃前提条件・Fortinet FortiSandbox、FortiSandbox Cloud、または FortiSandbox PaaS を使用している・影響を受けるバージョンを使用している・攻撃者が対象の FortiSandbox WEB UI へネットワーク経由でアクセスできる・攻撃者は認証情報を必要としない・修正済みバージョンへ更新されていない ✅悪用時影響・FortiSandbox 上で任意の OS コマンドを実行される可能性がある・FortiSandbox の管理機能または分析基盤を不正操作される可能性がある・セキュリティ分析基盤を侵害され、検知回避や追加侵害の足掛かりに利用される可能性がある・機密性、完全性、可用性に高い影響が生じる ✅悪用事例等に関する公開情報・PoC/Exploit：一部公開（技術情報のみ）・ITW：確認済み（Defused）・概要：Defused Cyber が共有した脅威インテリジェンスでは、CVE-2026-25089 を含む FortiSandbox 脆弱性群に対する悪用開始を報告。 ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-25089 ・https://fortiguard.fortinet.com/psirt/FG-IR-26-141 ・https://github.com/cisagov/vulnrichment/blob/develop/2026/25xxx/CVE-2026-25089.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089 ・https://www.yazoul.net/advisory/cve/cve-2026-25089-fortisandbox-unauth-rce-poc/ ・https://iototsecnews.jp/2026/06/16/hackers-exploit-critical-fortinet-fortisandbox-flaws-in-active-attacks/ ・https://jvndb.jvn.jp/ja/cwe/CWE-78.html CVE-2026-39808 Fortinet FortiSandbox OS Command Injection Vulnerability ✅概要・深刻度：緊急 9.8 (CVSS Base) / Fortinet, Inc. (CNA) ・種別：OSコマンドインジェクション (CWE-78) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Fortinet FortiSandbox に存在する OS コマンドインジェクションの脆弱性です。 FortiSandbox の API エンドポイントにおける入力処理に問題があり、未認証のリモート攻撃者が細工した HTTP リクエストを送信することで、不正なコードまたはコマンドを実行できる可能性があります。 ✅ChatGPTによる脆弱性評価・国内影響度：高・悪用難易度：低 ✅CISA 評価・攻撃自動化：自動化は可能・技術的影響：完全制御・BOD 26-04 対処期限（露出あり）：2026年7月19日・BOD 26-04 対処期限（露出なし）：2026年7月30日 ✅攻撃前提条件・Fortinet FortiSandbox 4.4.0 から 4.4.8 までの影響を受けるバージョンを使用している・攻撃者が対象の FortiSandbox API エンドポイントへネットワーク経由でアクセスできる・攻撃者は認証情報を必要としない・FortiSandbox 4.4.9 以降へ更新されていない ✅悪用時影響・FortiSandbox 上で不正なコードまたは OS コマンドを実行される可能性がある・root 権限でコマンドを実行される可能性がある・FortiSandbox の分析結果や管理機能を不正操作される可能性がある・セキュリティ分析基盤を起点に追加侵害へつなげられる可能性がある・機密性、完全性、可用性に高い影響が生じる ✅悪用事例等に関する公開情報・PoC/Exploit：公開済み・ITW：確認済み（Defused） ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-39808 ・https://fortiguard.fortinet.com/psirt/FG-IR-26-100 ・https://github.com/cisagov/vulnrichment/blob/develop/2026/39xxx/CVE-2026-39808.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39808 ・https://github.com/samu-delucas/CVE-2026-39808 CVE-2026-58644 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability ✅概要・深刻度：緊急 9.8 (CVSS Base) / Microsoft Corporation (CNA) ・種別：信頼できないデータのデシリアライゼーション (CWE-502) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Microsoft Office SharePoint に存在する、信頼できないデータのデシリアライゼーションに起因するリモートコード実行の脆弱性です。未認証の攻撃者がネットワーク経由で悪用することで、SharePoint 上でコードを実行できる可能性があります。 ✅ChatGPTによる脆弱性評価・国内影響度：高・悪用難易度：低 ✅CISA 評価・攻撃自動化：自動化は可能・技術的影響：完全制御・BOD 26-04 対処期限（露出あり）：2026年7月19日・BOD 26-04 対処期限（露出なし）：2026年7月30日 ✅攻撃前提条件・Microsoft SharePoint Enterprise Server 2016、Microsoft SharePoint Server 2019、または Microsoft SharePoint Server Subscription Edition を使用している・SharePoint Enterprise Server 2016 で 16.0.5556.1005 未満を使用している・SharePoint Server 2019 で 16.0.10417.20153 未満を使用している・SharePoint Server Subscription Edition で 16.0.19725.20384 未満を使用している・攻撃者が対象 SharePoint Server へネットワーク経由でアクセスできる・攻撃者は認証情報を必要としない・修正済み更新プログラムが適用されていない ✅悪用時影響・SharePoint Server 上でリモートコード実行につながる可能性がある・SharePoint Server 上の機密情報へ不正アクセスされる可能性がある・SharePoint Server 上のデータを改ざんされる可能性がある・SharePoint Server の可用性に影響が生じる可能性がある・オンプレミス SharePoint 環境を起点に追加侵害へつなげられる可能性がある ✅悪用事例等に関する公開情報・PoC/Exploit：公開情報確認できず・ITW：未確認 ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-58644 ・https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644 ・https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-58644.json ・https://github.com/cisagov/vulnrichment/blob/develop/2026/58xxx/CVE-2026-58644.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644 https://www.cisa.gov/news-events/alerts/2026/07/16/cisa-adds-three-known-exploited-vulnerabilities-catalog #vulnerability
Post summary
CISA announces three Fortinet FortiSandbox OS command injection CVEs and a Microsoft SharePoint deserialization CVE that are actively exploited, with PoC and exploit code publicly available and vendor patch guidance referenced.
1502888.3K
44.2K followersView on X
Dark Web Intelligence@DailyDarkWeb87d
Active Exploitation
CISA confirms exploitation of critical SharePoint zero-day CISA added CVE-2026-58644, a critical SharePoint Server deserialization vulnerability, to its Known Exploited Vulnerabilities catalog. Microsoft confirmed that the flaw was exploited as a zero-day before patches became available on July 14. CISA also warned that attackers are chaining SharePoint vulnerabilities to execute code, steal IIS machine keys, establish persistence, and deploy malware. #DDW #CISA #Vulnerability #Microsoft
Post summary
CISA confirms that CVE-2026-58644, a critical deserialization flaw in SharePoint Server, is being actively exploited in the wild, with attackers chaining additional vulnerabilities before patches became available.
05024127.1K
202.1K followersView on X
The Shadowserver Foundation@Shadowserver81d
Active Exploitation
Still seeing substantial amounts of Microsoft SharePoint unpatched instances that have been added to @CISACyber Known Exploited Vulnerability catalog last few weeks. This includes CVE-2026-50522, CVE-2026-56164, CVE-2026-58644 with 878 IPs (1585 FQDNs) unpatched on 2026-07-23 https://t.co/SOfpB5bi3v
Post summary
The tweet reports that several SharePoint CVEs are listed in the CISA Known Exploited Vulnerability catalog and remain unpatched, indicating a continuing exploitation risk.
1701662.8K
22.0K followersView on X
CERT-FR@CERT_FR83d
Active Exploitation
⚠️Alerte CERT-FR⚠️ Les vulnérabilités CVE-2026-50522 et CVE-2026-58644 permettent une exécution de code arbitraire à distance non authentifiée sur SharePoint et sont activement exploitées. https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-008/
Post summary
The alert confirms that CVE‑2026‑50522 and CVE‑2026‑58644 allow unauthenticated remote code execution on SharePoint and are currently being actively exploited.
0601038.0K
58.2K followersView on X
ProtAAPP - Protege las AAPP@ProtAAPP88d
Active Exploitation
La CISA ha añadido la vulnerabilidad crítica CVE-2026-58644 de Microsoft SharePoint Server a su catálogo de vulnerabilidades explotadas. Permite a atacantes autenticados ejecutar código arbitrario. Se recomienda aplicar parches antes del 19 de julio de… https://thehackernews.com/2026/07/cisa-adds-exploited-sharepoint-rce-zero.html https://t.co/BTkNlIb3TG
Post summary
CISA has listed CVE‑2026‑58644 as an actively exploited RCE in Microsoft SharePoint Server, urging users to apply patches by July 19.
140831.2K
8.3K followersView on X
Cytex@cytexsmb61d
Active Exploitation
SharePoint's JWT token validation pipeline just became the latest example of a pattern we keep seeing: authentication bypass through chained weaknesses that no single check catches. CVE-2026-55040 combines four distinct flaws: disabled signature requirements, x5t resolution without verification, issuer validation that accepts unregistered certificates, and non-cryptographic signature checks. The result allows an unauthenticated attacker to forge a valid JWT and impersonate any SharePoint site user or administrator. Rapid7 released a PoC on August 10. Exploitation attempts spiked from July 19 to August 13, with eight of 12 recorded attempts occurring on August 12 and 13. The public PoC is now being used in the wild. This is the fifth SharePoint vulnerability exploited this year, following CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522. Authentication bypass vulnerabilities don't usually start with a single catastrophic bug. They start with multiple small flaws that, when chained together, create a path that bypasses every control in the stack. The engineering assumption that each layer will catch what the previous layer missed is what fails. When you disable signature verification and then build custom validation logic that doesn't verify signatures, you've just moved the failure point. How are you validating that your authentication logic actually verifies what it claims to verify and not just accepting tokens that look like they should work?
Post summary
SharePoint CVE‑2026‑55040 is actively exploited; a public PoC was released by Rapid7 with documented attack attempts, highlighting chained authentication bypass flaws.
01284735
848 followersView on X
LA₿ 312 | 🛡️🔑📡#FREESAMOURAI@Lab312_89d
Active Exploitation
🛡️ LAB312 - Veille Cybersécurité & Bitcoin CISA ajoute le zero-day SharePoint RCE CVE-2026-58644 au KEV - La faille d'exécution de code à distance sur Microsoft SharePoint Server est activement exploitée ; les agences fédérales américaines doivent la corriger en urgence. @TheHackersNews CISA ordonne le patch urgent de failles Fortinet et Oracle exploitées - Deux vulnérabilités actives (FortiSandbox et Oracle E-Business Suite) visées par des attaques en cours ; échéance de correction imposée aux agences fédérales ce week-end. - @BleepinComputer OkoBot : nouveau framework avec 20 payloads pour voler crypto et identifiants - Une cadre malveillant livre plus de 20 charges utiles ciblant les phrases mnémoniques de portefeuilles Bitcoin, credentials et données sensibles. -Bleepin gComputer ClickLock : malware macOS qui force la saisie du mot de passe - Le voleur d'infos tue les apps en boucle (toutes les ~210 ms) jusqu'à ce que la victime tape son login, via une commande collée dans Terminal. - BleepingComputer / The Hacker News Hackers russes trojanisent WebEx et Zoom pour livrer Starland RAT - Le groupe UAT-11795 injecte un backdoor dans des logiciels piégés pour voler credentials et crypto. - BleepingComputer n8n : faille d'échange de token permet de se connecter comme un autre utilisateur - Sur les instances Enterprise multi-émetteurs, un JWT est apparié sur le seul claim « sub », ignorant l'émetteur d'origine. - The Hacker News Nouvelles attaques par injection de données contre les agents IA - Un avis ou un commentaire piégé suffit à faire exécuter des commandes ou cliquer à la place de l'utilisateur (achat, exécution de code). - The Hacker News 23andMe : 18 M$ d'amende pour violation des données génétiques - La société de tests ADN règle un litige avec 43 procureurs américains pour défaut de protection des données génétiques clients. - BleepingComputer CJUE : contourner un géoblocage par VPN n'est pas illégal - La Cour de justice de l'UE a précisé que l'usage d'un VPN pour accéder à un contenu géobloqué ne constitue pas une infraction de piratage. - @Korben Mozilla fustige les dark patterns de Microsoft sur le choix du navigateur - La fondation dénonce les pratiques de Microsoft forçant la main des utilisateurs sur la sélection par défaut de Edge/Windows. - @nextinpact Scattered Spider : 5,5 ans de prison pour le hack de Transport for London - Deux membres du collectif écopent de la plus grosse condamnation cybercriminelle de l'histoire judiciaire britannique (148 systèmes TfL neutralisés). - @TheRegister Cloudflare (x402) ouvre la voie aux micro-paiements Bitcoin pour agents IA - L'adoption du protocole x402 permet la monétisation de données par paiements crypto directs, Bitcoin et Lightning inclus, pour les agents autonomes. -@BitcoinMagazine Période : 24 h (16→17 juil. 2026) · par la Sentinel 312
Post summary
CISA has added CVE‑2026‑58644, a SharePoint RCE, to the KEV, noting it is actively exploited and mandating urgent patching of federal agencies.
21092889
2.9K followersView on X
GovCERT.CZ@GOVCERT_CZ88d
Active Exploitation
🚨 Upozorňujeme na kritickou, aktivně zneužívanou zranitelnost v Microsoft SharePoint Server, CVE-2026-58644. Jedná se o kritickou zranitelnost typu deserialization of untrusted data s hodnocením CVSS 9.8, která umožňuje neautorizovanému útočníkovi vzdálené spuštění libovolného kódu. Zranitelnost je vzdáleně zneužitelná přes internet a útočníkovi stačí oprávnění alespoň na úrovni Site Owner, aby mohl do SharePoint Serveru zapisovat a vzdáleně spouštět škodlivý kód. Microsoft upozorňuje, že útok nevyžaduje významnou znalost cílového systému a lze jej opakovaně úspěšně zneužívat proti zranitelné komponentě. Zranitelnost postihuje Microsoft SharePoint Server Subscription Edition, Microsoft SharePoint Server 2019 a Microsoft SharePoint Enterprise Server 2016. Opravy byly vydány v rámci aktualizací Patch Tuesday dne 14. 7. 2026, přičemž Microsoft následně potvrdil aktivní zneužívání této zranitelnosti. Doporučeno je neprodleně aplikovat bezpečnostní aktualizace, ověřit aktivaci AMSI integrace, monitorovat známky kompromitace, omezit přístup k SharePoint administraci a nevystavovat SharePoint servery přímo do internetu, pokud to není nezbytné. 📌Doporučujeme aktualizovat na nejnovější verzi.
Post summary
Údaje uvádí, že CVE-2026-58644 je kritická zranitelnost typu deserializace, aktivně zneužívaná v SharePointu a že Microsoft již vydal opravy, které je třeba okamžitě nasadit.
02080738
4.3K followersView on X
Rahmi Demir ⭐⭐⭐⭐⭐@rahmid3mir88d
Patch
🪲🪲🪲 Siber Güvenlik Zaafiyet Bülteni #SiberGüvenlik #GüvenlikBülteni Merhaba #Brolyz 🎯 Zafiyet Bilgisi Ürün: #Microsoft #SharePoint Server #Zafiyet: Güvenilmeyen Verinin Serileştirilmesinin Çözülmesi (Deserialization of Untrusted Data) CVE: CVE-2026-58644 Zafiyet Türü: Deserialization of Untrusted Data (CWE-502) Fidye Yazılımı İlişkisi: Şu an için bilinmiyor 📌 Zafiyet Özeti Microsoft SharePoint Server üzerinde, Güvenilmeyen Verinin Serileştirilmesinin Çözülmesi (Deserialization of Untrusted Data) zafiyeti tespit edilmiştir Bu güvenlik açığı, kimlik doğrulaması gerektirmeyen bir saldırganın ağ üzerinden uzaktan kod çalıştırmasına (Remote Code Execution - RCE) olanak tanıyabilir Başarılı bir istismar sonucunda saldırgan, SharePoint sunucusu üzerinde keyfi kod çalıştırabilir,hassas verilere erişebilir,sistem üzerinde tam kontrol sağlayabilir ve kurumsal ağ içerisinde yatay hareket (Lateral Movement) gerçekleştirebilir 🛡️ Önerilen Aksiyonlar ✅ Güvenlik Güncellemeleri Microsoft tarafından yayımlanan güvenlik güncellemelerini ve önerilen hafifletici önlemleri (Mitigations) test ettikten sonra en kısa sürede canlı ortama uygulayın ✅ Risk Yönetimi Süreçlerinizi CISA'nın BOD 26-04 (Risk Tabanlı Güvenlik Güncellemelerinin Önceliklendirilmesi) ve Forensics Triage Requirements rehberlerine uygun şekilde yönetin ✅ Erişim Kontrolleri İnternete açık SharePoint sunucularını öncelikli olarak değerlendirin. Gereksiz dış erişimleri sınırlandırın, yönetim arayüzlerini yalnızca güvenilir ağlardan erişilebilir hale getirin IIS ve SharePoint günlüklerini (logs) düzenli olarak izleyin ve olağan dışı etkinlikleri tespit etmek için güvenlik izleme çözümlerini aktif kullanın ✅ Geçici Koruma Önlemleri Güvenlik güncellemesi veya önerilen hafifletici önlemler uygulanamıyorsa, SharePoint sunucularına internet erişimini sınırlandırın veya risk değerlendirmesi doğrultusunda ilgili servisi geçici olarak devre dışı bırakmayı değerlendirin 📚 Referans: Microsoft Security Response Center (MSRC) & CISA
Post summary
The bulletin discloses a deserialization flaw (CVE‑2026‑58644) in Microsoft SharePoint Server and gives clear guidance on applying security updates and mitigations.
0106040
530 followersView on X
Canadian Centre for Cyber Security@cybercentre_ca90d
Patch
#CyberAlert | Critical vulnerabilities impacting Microsoft SharePoint Server We recommend that organizations update or upgrade affected Microsoft SharePoint Server instances without delay. Learn more: https://www.cyber.gc.ca/en/alerts-advisories/al26-017-critical-vulnerabilities-impacting-microsoft-sharepoint-server-cve-2026-56164-cve-2026-55040-cve-2026-58644 https://t.co/rST8qAZDJe
Post summary
The alert warns of critical SharePoint Server vulnerabilities and urges organizations to apply updates or upgrades immediately.
31030819
34.0K followersView on X
DFIR Radar@DFIR_Radar86d
Active Exploitation
Six CVEs hit on-prem SharePoint in July 2026, four now in CISA KEV with active exploitation confirmed. Unauthenticated RCE and auth bypass can chain from a single web request to full domain compromise. - CVE-2026-56164 (CVSS 9.8, unauthenticated auth bypass, KEV due July 17) and CVE-2026-58644 (CVSS 9.8, unauthenticated deserialization RCE, KEV due July 19) are the sharpest edge: no credentials required to reach code execution on SharePoint Server 2016, 2019, and Subscription Edition. CVE-2026-45659 (CVSS 8.8, authenticated deserialization RCE) and CVE-2026-32201 (CVSS 6.5, input validation spoofing) round out the confirmed-exploited set. CVE-2026-55040 (CVSS 9.1, JWT bypass) and CVE-2026-50522 (CVSS 9.8, unauthenticated deserialization) are not yet in KEV but must be patched now. Rapid7 flagged CVE-2026-55040 as part of a two-bug unauthenticated RCE chain; the companion bug lands in August 2026 patches. #DFIR_Radar
Post summary
Several SharePoint CVEs are being actively exploited in the wild, with four already in the CISA KEV, and urgent patches are required.
20011284
1.8K followersView on X
Directoratul Național de Securitate Cibernetică@DNSC_RO89d
Active Exploitation
🔴 ALERTĂ: Vulnerabilități critice în Microsoft SharePoint. CVE-2026-50522 și CVE-2026-58644 (CVSS 9.8) permit execuție de cod la distanță. CVE-2026-58644 este exploatată activ. Detalii: https://www.dnsc.ro/citeste/alert-vulnerabilit-i-critice-n-microsoft-sharepoint #DNSC #CyberSecurity #SharePoint https://t.co/QguYaw5A9d
Post summary
The alert reports that Microsoft SharePoint vulnerabilities CVE-2026-50522 and CVE-2026-58644 enable remote code execution, with CVE‑2026‑58644 being actively exploited, as detailed in the linked security article.
01030372
4.7K followersView on X
DFIR Radar@DFIR_Radar89d
Active Exploitation
Four on-premises SharePoint Server CVEs are actively exploited: CVE-2026-32201 (CVSS 6.5), CVE-2026-45659 (CVSS 8.8), CVE-2026-56164 (CVSS 9.8), and CVE-2026-58644 (CVSS 9.8). #DFIR_Radar https://t.co/ln2QdK28Q8
Post summary
The tweet reports that four SharePoint Server CVEs are being exploited in the wild, underscoring a serious security threat.
20011214
1.8K followersView on X
鯖乃ミル⭐️beyondバーチャル広報@byd_sabano71d
Active Exploitation
おはようございます！【今日のITメモ📌】 SharePointの重大な脆弱性（CVE-2026-58644）、なんと"パッチ公開前"から悪用されてたんだって⚠️ 社内でSharePoint使ってる人は、更新できてるか今すぐ確認してね🐟 #ITニュース #セキュリティ #情シス
Post summary
The post reports that SharePoint CVE-2026-58644 has reportedly been exploited before the official patch was released, urging users to verify they have applied the update.
0003093
548 followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	microsoft	sharepoint_server	-	-	-
App	microsoft	sharepoint_server	2016	-	-
App	microsoft	sharepoint_server	2019	-	-

Explore more

Back to dashboard microsoft CVEs sharepoint_server vulnerabilities

What researchers are saying

CVE-2026-58644

Censys[verified]@censysioActive Exploitation

Two critical SharePoint Server CVEs allow unauthenticated RCE; CVE‑2026‑58644 is confirmed exploited, and a patch has been released.

piyokango[verified]@piyokangoActive Exploitation

CISA announces three Fortinet FortiSandbox OS command injection CVEs and a Microsoft SharePoint deserialization CVE that are actively exploited, with PoC and exploit code publicly available and vendor patch guidance referenced.

Dark Web Intelligence[verified]@DailyDarkWebActive Exploitation

CISA confirms that CVE-2026-58644, a critical deserialization flaw in SharePoint Server, is being actively exploited in the wild, with attackers chaining additional vulnerabilities before patches became available.

Cytex[verified]@cytexsmbActive Exploitation

SharePoint CVE‑2026‑55040 is actively exploited; a public PoC was released by Rapid7 with documented attack attempts, highlighting chained authentication bypass flaws.

LA₿ 312 | 🛡️🔑📡#FREESAMOURAI[verified]@Lab312_Active Exploitation

CISA has added CVE‑2026‑58644, a SharePoint RCE, to the KEV, noting it is actively exploited and mandating urgent patching of federal agencies.

GovCERT.CZ[verified]@GOVCERT_CZActive Exploitation

Údaje uvádí, že CVE-2026-58644 je kritická zranitelnost typu deserializace, aktivně zneužívaná v SharePointu a že Microsoft již vydal opravy, které je třeba okamžitě nasadit.

Rahmi Demir ⭐⭐⭐⭐⭐[verified]@rahmid3mirPatch

The bulletin discloses a deserialization flaw (CVE‑2026‑58644) in Microsoft SharePoint Server and gives clear guidance on applying security updates and mitigations.

DFIR Radar[verified]@DFIR_RadarActive Exploitation

Several SharePoint CVEs are being actively exploited in the wild, with four already in the CISA KEV, and urgent patches are required.