What’s Vulnerable › Vulnerabilities

CVE-2026-58644: Microsoft SharePoint Remote Code Execution Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-07-16
• EPSS: 15.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-07-14 · updated 2026-10-28
• Weakness: CWE-502

Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Summary

CVE-2026-58644 is a critical deserialization-of-untrusted-data flaw in Microsoft SharePoint Server that lets an unauthenticated attacker execute code over the network (CVSS 9.8). It is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, a public exploit or detection template exists, and EPSS estimates a 15.9% chance of exploitation in 30 days. Affected is Microsoft SharePoint Server, fixed in version 16.0.19725.20434. Apply the vendor update or mitigations per CISA BOD 26-04, assess internet exposure, and discontinue use if mitigations are unavailable.

تُعدّ CVE-2026-58644 ثغرة حرجة من نوع إزالة تسلسل البيانات غير الموثوقة في Microsoft SharePoint Server، وتتيح لمهاجم غير مصرّح له تنفيذ تعليمات برمجية عبر الشبكة (CVSS 9.8). الثغرة مدرجة في كتالوج CISA للثغرات المعروفة باستغلالها مع استغلال نشط، ويتوفر استغلال عام أو قالب كشف، وتقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 15.9%. المنتج المتأثر هو Microsoft SharePoint Server، وأُصلحت الثغرة في الإصدار 16.0.19725.20434. طبّق تحديث المورّد أو التخفيفات وفق CISA BOD 26-04، وقيّم تعرّض الأصول للإنترنت، وتوقّف عن استخدام المنتج إذا لم تتوفر التخفيفات.

Affected products

• Microsoft SharePoint Server: before 16.0.19725.20434; 2016, 2019 — fixed in 16.0.19725.20434
• Microsoft SharePoint Server Subscription Edition: from 16.0.0 before 16.0.19725.20384 — fixed in 16.0.19725.20384
• Microsoft Sharepoint Enterprise Server 2016: from 16.0.0 before 16.0.5556.1005 — fixed in 16.0.5556.1005
• Microsoft SharePoint Server: from 16.0.0 before 16.0.10417.20153 — fixed in 16.0.10417.20153

How to fix

Upgrade to a fixed version: Microsoft SharePoint Server 16.0.19725.20434; Microsoft SharePoint Server Subscription Edition 16.0.19725.20384; Microsoft Sharepoint Enterprise Server 2016 16.0.5556.1005; Microsoft SharePoint Server 16.0.10417.20153. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644

Get alerted when CVE-2026-58644 or the next vulnerability affects your stack