CISA Alerts on Critical SharePoint Zero-Day CVE-2026-58644 Under Active Exploitation

Executive Summary

On July 16, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added a critical security flaw in Microsoft SharePoint Server, tracked as CVE-2026-58644, to its Known Exploited Vulnerabilities (KEV) catalog. This disclosure follows the massive July 2026 Patch Tuesday release, where Microsoft addressed 622 vulnerabilities, including two other zero-days currently seen in the wild: CVE-2026-56155 (Active Directory Federation Services Privilege Escalation) and CVE-2026-56164 (SharePoint Privilege Escalation). The immediate addition of CVE-2026-58644 to the KEV highlights an urgent threat to on-premises enterprise environments globally.

Threat Analysis

The vulnerability, carrying a CVSS score of 9.8, involves the deserialization of untrusted data. Threat actors are actively exploiting this flaw to gain an initial foothold in corporate networks. By targeting internet-facing SharePoint instances, attackers can achieve Remote Code Execution (RCE) without requiring prior authentication. Once inside, the primary objective observed in recent campaigns is the theft of Internet Information Services (IIS) machine keys. These keys are critical for persistence, as they allow attackers to forge authentication cookies and maintain access even after password resets or service restarts.

Technical Details

CVE-2026-58644 stems from an insecure deserialization sink within the SharePoint application logic. An attacker can send a specially crafted network request containing serialized objects that, when processed by the server, execute arbitrary commands in the context of the SharePoint service account.

Related zero-days disclosed this week include:

• CVE-2026-56155 (CVSS 7.8): An ADFS privilege escalation flaw where insufficient access control allow authenticated attackers to forge trusted identities within a domain.
• CVE-2026-56164 (CVSS 7.8): A SharePoint privilege escalation vulnerability that allows low-privileged users to gain administrator-level rights, facilitating lateral movement to domain controllers.

Attribution Assessment

While no specific nation-state actor has been definitively linked to the CVE-2026-58644 campaign, the tradecraft observed—specifically the surgical extraction of IIS machine keys and the targeting of ADFS—aligns with advanced persistent threat (APT) groups focused on long-term espionage and credential harvesting. However, the rapid weaponization of the exploit suggests that cybercriminal syndicates may also be leveraging the flaw for ransomware deployment, as evidenced by similar historical patterns involving file-sharing and collaboration platforms.

Implications

The exploitation of SharePoint is rarely an end-goal. For most threat actors, a compromised SharePoint server acts as a high-value pivot point. With the ability to execute code and steal machine keys, an attacker can effectively bypass traditional perimeter defenses and move laterally into sensitive databases, backups, and identity infrastructure. Organizations relying on on-premises SharePoint 2016, 2019, or Subscription Edition are at extreme risk if they do not rotate keys and apply patches immediately.

Recommendations

Encrygma recommends the following immediate actions for all affected organizations:

1. Priority Patching: Apply the Microsoft July 2026 security updates for SharePoint Server and ADFS immediately. Federal agencies must comply by the July 19 deadline.
2. Verify AMSI Integration: Ensure that the Antimalware Scan Interface (AMSI) is enabled and configured in 'Full Mode' for all SharePoint web applications to detect malicious script execution.
3. Key Rotation: If signs of compromise are detected, rotate IIS machine keys only after ensuring the environment is clean of harvesting tools.
4. Credential Audit: Review all ADFS authentication logs for anomalous federation requests or the creation of unauthorized trusted identities.