Everyone focused on the SharePoint privilege-escalation zero-day. CVE-2026-58644 is worse: an unauthenticated deserialization flaw that runs code on the server, actively exploited, with a CISA deadline that's already passed.
July's SharePoint headlines went to the privilege-escalation zero-day, but there's a second SharePoint flaw that's arguably worse and got less attention. CVE-2026-58644 is a 9.8 deserialization vulnerability that lets an unauthenticated attacker run code on the SharePoint server over the network — no login, no user interaction. It's actively exploited and on CISA's Known Exploited Vulnerabilities catalog with a remediation deadline that has already passed. If you run on-premises SharePoint and only patched the one everyone talked about, check that you've closed this one too.
0.0/ 10
CVSS severity: Critical
Unauthenticated deserialization RCE (CWE-502) — exploited in the wild, on CISA KEV.
Why deserialization bugs are a SharePoint classic
Deserialization flaws — where an app rebuilds objects from attacker-controlled data without validating it — have been a recurring SharePoint weakness for years, and they're dangerous precisely because they turn 'send some data' into 'run some code.' CWE-502 is the pattern, and on a server that holds an organisation's documents and sits on the internal network, unauthenticated code execution is the worst outcome. The exploitation profile — network, no auth, no interaction — is the same one that made the DHCP and WebLogic bugs so urgent. That it's already on CISA's exploited list removes any doubt about priority.
SharePoint holds the documents and intranets of countless organisations — an unauthenticated RCE there is a direct route to sensitive data. · Unsplash
What to do
Confirm your on-prem SharePoint build against the patched versions and apply the July 2026 update if you haven't.
Verify you patched THIS CVE — it's separate from the SharePoint privilege-escalation zero-day that got more coverage.
Because it's exploited and pre-auth, hunt for signs of compromise on internet-facing SharePoint servers.
Enable AMSI integration for SharePoint, which can help detect malicious requests as defence-in-depth.
Quick answers
Is this the same as the SharePoint zero-day everyone patched?
No — that was CVE-2026-56164, a privilege-escalation flaw. CVE-2026-58644 is a separate deserialization vulnerability that gives unauthenticated remote code execution, which is arguably more severe. Both were in the July release and both are on CISA's exploited list. If you only patched one, verify you've addressed both — they're different bugs with different fixes in the same update, and the RCE is the one to be sure about.
Which SharePoint versions are affected?
On-premises SharePoint Server 2016 (Enterprise), 2019, and Subscription Edition, below specific patched builds. SharePoint Online (Microsoft 365) is patched by Microsoft and needs no action from you. If you run your own SharePoint servers, confirm the build number against the July update and patch — this one is actively exploited, so an unpatched internet-facing server should be considered at high risk.
The CISA deadline passed — what does that mean for me?
CISA deadlines are binding for US federal agencies, not private companies, but they're a strong signal of urgency for everyone. That the deadline (July 19) has passed means this has been a known, exploited, high-priority bug for weeks — so if you're still unpatched, you're well into the danger zone. Patch immediately and assume an internet-facing, long-unpatched server may already be compromised.
Don't let the higher-profile SharePoint zero-day distract from this one: an unauthenticated, actively-exploited 9.8 RCE deserves top priority. Patch, verify you got both SharePoint bugs, and hunt if you were exposed. Sources: NVD and CISA KEV. See also the SharePoint EoP and WebLogic criticals.
