CVE-2026-58644: Microsoft SharePoint Deserialization Of Untrusted Data Vulnerability Actively Exploited (CISA KEV)

Security researchers and government agencies have confirmed that a critical vulnerability in Microsoft SharePoint, identified as CVE-2026-58644, is actively being exploited by malicious actors to execute remote code. This flaw involves the deserialization of untrusted data, allowing attackers to compromise affected systems without user interaction. The development underscores the urgent need for organizations to implement recommended mitigations to prevent potential breaches.

The vulnerability, CVE-2026-58644, was disclosed by Microsoft and is classified as a deserialization flaw that impacts certain versions of SharePoint. According to the Cybersecurity and Infrastructure Security Agency (CISA), threat actors are actively exploiting this weakness in targeted attacks, which could lead to full system compromise.

Microsoft has issued security advisories urging administrators to apply available patches and mitigations. The flaw allows an attacker to send maliciously crafted data to SharePoint servers, which, when deserialized, can execute arbitrary code with the same privileges as the SharePoint service. This could enable attackers to install malware, steal data, or take control of affected systems.

While Microsoft has provided guidance on mitigations, it is not yet clear how widespread the exploitation is or which organizations are most affected. Security firms are monitoring the situation closely, and some have issued alerts to their clients to review SharePoint configurations and apply updates promptly.

Why This Vulnerability Is a Critical Threat to Organizations

This vulnerability is significant because it enables remote code execution, one of the most severe types of security flaws. If exploited, attackers could gain persistent access to enterprise networks, potentially leading to data breaches, ransomware deployment, or disruption of business operations. The active exploitation increases the urgency for organizations to respond quickly.

Given SharePoint’s widespread use in corporate environments for document management and collaboration, the impact could be extensive if attackers target vulnerable systems. The vulnerability’s nature also raises concerns about similar deserialization flaws in other enterprise software.

Details on the SharePoint Deserialization Vulnerability and Its Discovery

The CVE-2026-58644 flaw was identified during routine security assessments and was publicly disclosed by Microsoft in their security advisory. The vulnerability involves the deserialization process within SharePoint, which improperly handles untrusted data, leading to code execution.

Security researchers have noted that deserialization vulnerabilities are a common attack vector, especially in complex enterprise applications. Microsoft’s patch addresses the flaw by improving input validation and deserialization safeguards.

Prior to this active exploitation, the vulnerability was considered high severity but was not known to be exploited in the wild. The current attacks mark a significant escalation, emphasizing the importance of timely patching.

“CISA has confirmed that CVE-2026-58644 is actively being exploited in targeted attacks, posing a serious threat to affected organizations.”

— CISA

Extent and Scope of the Current Exploitation Unknown

While authorities and Microsoft confirm active exploitation, details about the specific threat actors, targeted sectors, and the full scope of affected organizations remain unclear. It is also uncertain how quickly the vulnerability will be patched across all affected systems, and whether additional exploits or variants may emerge.

Expected Response and Future Security Measures

Organizations are advised to review Microsoft’s security advisories, apply patches immediately, and monitor network activity for signs of exploitation. Security vendors are tracking the threat and may release additional detection tools or updates. Microsoft is expected to continue investigating the vulnerability and release further guidance if new developments occur.

Key Questions

What is CVE-2026-58644?

CVE-2026-58644 is a security vulnerability in Microsoft SharePoint that involves deserialization of untrusted data, enabling remote code execution.

How is this vulnerability being exploited?

Threat actors are sending malicious data to vulnerable SharePoint servers, which, when deserialized, allow execution of arbitrary code, leading to potential system compromise.

What should organizations do now?

Apply all relevant security patches from Microsoft, follow official mitigation guidance, and monitor systems for suspicious activity.

Is this vulnerability widespread?

It is currently confirmed to be exploited in targeted attacks, but the full extent of affected organizations remains unknown.

Will Microsoft release additional updates?

Microsoft is expected to continue monitoring the situation and may release further updates or guidance as needed.

Source: kev