CVE-2026-58644

CRITICAL KEV

Microsoft SharePoint Remote Code Execution Vulnerability

Title source: cna
STIX 2.1

Exploitation Summary

CVE-2026-58644 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added July 16, 2026. EIP tracks 1 public exploit from researchers including WismanSec.

AI-analyzed exploit summary This repository provides a functional proof-of-concept exploit for CVE-2026-58644, a deserialization vulnerability in SharePoint's `/_trust` endpoint. The exploit leverages ysoserial.net gadgets to achieve remote code execution (RCE) or machine key extraction via crafted SecurityContextToken cookies in WS-Federation requests.

Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Exploits (1)

github WORKING POC
by WismanSec · htmlremote
https://github.com/WismanSec/sharepoint-2026-poc

This repository provides a functional proof-of-concept exploit for CVE-2026-58644, a deserialization vulnerability in SharePoint's `/_trust` endpoint. The exploit leverages ysoserial.net gadgets to achieve remote code execution (RCE) or machine key extraction via crafted SecurityContextToken cookies in WS-Federation requests.

Classification
Working Poc 98%
Attack Type
Deserialization
Complexity
Moderate
Reliability
Reliable
Target: Microsoft SharePoint (2026 versions, likely patched post-CVE-2026-58644)
No auth needed
Prerequisites: Access to SharePoint's `/_trust/default.aspx` endpoint · ysoserial.net tool for gadget generation · Target must not have AMSI request-body scanning enabled for `/_trust`
mistral-large-3 · analyzed Aug 07, 2026 Full analysis →

References (2)

Core 2
Core References
Vendor Advisory vendor-advisory patch
Microsoft SharePoint Remote Code Execution Vulnerability
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644

Scores

CVSS v3 9.8
EPSS 0.0637
EPSS Percentile 93.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable yes
Technical Impact total

Details

CISA KEV 2026-07-16
VulnCheck KEV 2026-07-14
ENISA EUVD EUVD-2026-43779
CWE
CWE-502
Status published
Products (6)
Microsoft/Microsoft SharePoint Enterprise Server 2016 16.0.0 - 16.0.5556.1005
Microsoft/Microsoft SharePoint Server 2019 16.0.0 - 16.0.10417.20153
Microsoft/Microsoft SharePoint Server Subscription Edition 16.0.0 - 16.0.19725.20384
microsoft/sharepoint_server 2016
microsoft/sharepoint_server 2019
microsoft/sharepoint_server < 16.0.19725.20434
Published Jul 14, 2026
KEV Added Jul 16, 2026
Tracked Since Jul 14, 2026