CVE-2026-58644 Microsoft CVE debrief

Who should care

Organizations using Microsoft SharePoint should prioritize patching this vulnerability, as it has been added to the CISA Known Exploited Vulnerabilities catalog. IT teams responsible for SharePoint deployments, security teams, and vulnerability management teams should be aware of this vulnerability and take necessary actions to secure their systems.

Technical summary

CVE-2026-58644 is a deserialization of untrusted data vulnerability in Microsoft SharePoint. The vulnerability allows an attacker to execute arbitrary code on the affected system by deserializing untrusted data. This type of vulnerability is often exploited in attacks to gain unauthorized access to systems. Microsoft has provided guidance on this issue, and organizations should apply patches or mitigations as recommended. The vulnerability affects Microsoft SharePoint deployments, and defenders should focus on securing these systems.

Defensive priority

High

Recommended defensive actions

• Apply mitigations in accordance with vendor instructions
• Ensure compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk guidance
• Follow CISA's Forensics Triage Requirements
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CISA Known Exploited Vulnerabilities catalog lists this vulnerability as actively exploited. Microsoft has provided guidance on this issue. Organizations should verify their SharePoint deployments against the CVE and apply patches or mitigations as recommended by Microsoft. Evidence of exploitation is limited, but defenders should review SharePoint logs for suspicious deserialization activity. Additional verification steps include checking for unusual system behavior and ensuring that all SharePoint components are up-to-date.

Official resources