CISA Flags Actively Exploited Microsoft SharePoint Vulnerability

CISA has officially added CVE-2026-58644 to its Known Exploited Vulnerabilities catalog, confirming that this Microsoft SharePoint flaw is currently being leveraged in real-world attacks. Because this vulnerability allows an unauthorized attacker to execute code over a network, it poses an immediate threat to the integrity and security of affected SharePoint deployments.

What's at Risk

The vulnerability affects Microsoft SharePoint, a widely used enterprise collaboration platform. Organizations that maintain internet-facing instances of SharePoint are at the highest risk, as the flaw allows for remote code execution without the need for authentication. Any organization relying on SharePoint for internal or external document management and collaboration should consider their deployment a high-priority target until the necessary security measures are implemented.

How the Flaw Works

This vulnerability is classified as a deserialization of untrusted data issue (CWE-502). In general terms, deserialization occurs when an application takes data received from an untrusted source and attempts to reconstruct it into an object. If the application does not properly validate or sanitize this input, an attacker can craft malicious serialized objects that, when processed, force the application to execute arbitrary code. This class of weakness essentially allows an attacker to bypass standard input filters and hijack the application's execution flow, often resulting in a complete system compromise.

How to Protect Your Systems

• Apply all vendor-provided security mitigations immediately to address the deserialization flaw.
• Ensure full compliance with CISA’s BOD 26-04 requirements, including the remediation deadline of July 19, 2026.
• Follow CISA’s “Forensics Triage Requirements” to identify potential indicators of compromise within your environment.
• Restrict network and internet exposure for all SharePoint servers, ensuring that only necessary traffic is permitted.
• Implement strict network segmentation to limit the potential lateral movement if a SharePoint server is compromised.
• Monitor system logs for unusual activity or unauthorized execution attempts that may indicate exploitation.

The status of this flaw as actively exploited underscores the necessity of immediate action. Given that CISA has mandated a federal remediation deadline of July 19, 2026, organizations must prioritize this update to prevent potential unauthorized code execution. Delaying these mitigations leaves critical infrastructure exposed to attackers who are already actively seeking to leverage this specific vulnerability.