CISA KEV Alert: SharePoint RCE zero-day exploited in...

Executive Summary

On July 16, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-58644, a critical vulnerability in Microsoft SharePoint Server, to its Known Exploited Vulnerabilities (KEV) catalog. This action confirms the vulnerability has been actively exploited in the wild as a zero-day. The flaw is a deserialization of untrusted data with a CVSS score of 9.8, enabling an authenticated attacker to achieve remote code execution (RCE). Microsoft SharePoint Server is a common target for threat actors, and this flaw provides a direct path to server compromise. CISA has mandated that Federal Civilian Executive Branch (FCEB) agencies apply the patch by July 19, 2026. All organizations are strongly advised to prioritize patching and investigate for potential compromise.

Vulnerability Details

CVE ID: CVE-2026-58644
Severity: Critical
CVSS Score: 9.8
Vulnerability Type: Deserialization of Untrusted Data
Attack Vector: Network
Prerequisites: Attacker must be authenticated with "Site Owner" privileges.

The vulnerability allows an attacker who has already gained Site Owner-level privileges on a SharePoint site to inject and execute arbitrary code on the underlying server. While the attack requires prior authentication, the privileges needed are commonly held by departmental administrators or power users, not just server administrators. This makes the attack feasible once an initial foothold is gained through other means like phishing. The attack complexity is low.

Affected Systems

The vulnerability affects the following on-premises Microsoft SharePoint Server versions:

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Enterprise Server 2016

SharePoint Online is not affected.

Exploitation Status

Microsoft confirmed that CVE-2026-58644 was exploited as a zero-day before the patch was released on July 14, 2026. CISA's addition to the KEV catalog on July 16 reinforces the urgency. Threat actors are known to chain SharePoint vulnerabilities for post-exploitation activities. CISA noted that this flaw, along with others like CVE-2026-56164, is being used to steal IIS machine keys for further access and to deploy malware for persistence, such as web shells. This indicates that the exploit is being used by sophisticated actors for sustained access.

Impact Assessment

Successful exploitation of CVE-2026-58644 leads to full remote code execution on the SharePoint server, with severe potential impacts:

Server Compromise: Attackers gain control of the server, allowing them to install malware, including ransomware or backdoors like T1505.003 - Web Shell.
Data Exfiltration: Access to all data stored on the SharePoint server, including sensitive corporate documents, intellectual property, and personal information.
Lateral Movement: The compromised SharePoint server can be used as a pivot point to move laterally within the corporate network, escalating the breach.
Persistence: Attackers can establish long-term persistence by stealing IIS machine keys or deploying other malware, making remediation difficult.

IOCs — Directly from Articles

No specific file hashes, domains, or IP addresses were provided in the source articles for use as IOCs.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

Type

process_name

Value

w3wp.exe

Description

The IIS worker process that runs SharePoint. Monitor for this process spawning command shells (cmd.exe, powershell.exe) or making unusual network connections.

Context

EDR, Host-based logs

Type

file_path

Value

C:\inetpub\wwwroot\wss\VirtualDirectories\

Description

Default path for SharePoint web applications. Monitor for newly created or modified .aspx, .ashx, or .asmx files, which could be web shells.

Context

File Integrity Monitoring (FIM)

Type

event_id

Value

4688

Description

Windows Security Event ID for process creation. Enable command-line logging and audit for suspicious commands executed by the SharePoint application pool identity.

Context

Windows Event Logs, SIEM

Type

log_source

Value

SharePoint ULS Logs

Description

SharePoint's Unified Logging Service logs may contain errors or anomalies related to deserialization failures during an exploitation attempt.

Context

Application server log analysis

Detection & Response

Hunt for Web Shells: Proactively scan SharePoint server web directories for suspicious .aspx or other web-executable files. Use D3-FA: File Analysis to check for common web shell signatures and characteristics.
Process Monitoring: Implement EDR rules to detect when the w3wp.exe process initiates suspicious child processes like powershell.exe, cmd.exe, whoami.exe, or net.exe. This is a strong indicator of RCE.
Enable AMSI: As recommended by CISA, ensure the Antimalware Scan Interface (AMSI) integration for SharePoint is enabled. This allows endpoint security products to inspect scripts and commands executed by SharePoint for malicious content.
Review Site Owner Permissions: Audit all users and groups with "Site Owner" privileges. Scrutinize these accounts for any signs of compromise and reduce the number of accounts with this permission level to the absolute minimum required.

Mitigation

Apply Security Updates: The primary mitigation is to immediately apply the July 2026 security updates for the respective SharePoint Server versions. This is a direct implementation of D3-SU: Software Update.
Harden SharePoint: Follow CISA's guidance on SharePoint hardening. This includes disabling unused services, applying the principle of least privilege for service accounts, and restricting administrative access.
Network Segmentation: Isolate SharePoint servers from the general user network. Restrict outbound internet access from the servers to prevent easy data exfiltration or C2 communication. This aligns with D3-NI: Network Isolation.
Regular Audits: Implement regular, automated audits of SharePoint permissions and configurations to detect unauthorized changes or privilege escalation.

As a critical detection and response measure, security teams must implement D3-PA (Process Analysis) focused on the SharePoint server's IIS worker process, w3wp.exe. Configure EDR solutions and SIEM rules to generate high-severity alerts when w3wp.exe spawns anomalous child processes, particularly command-line interpreters like cmd.exe and powershell.exe, or reconnaissance tools like whoami.exe and net.exe. This is a classic indicator of web application compromise and RCE. Establish a baseline of normal process behavior for your SharePoint environment, as some legitimate administrative tasks might spawn processes. However, any interactive shells or unexpected outbound network connections from w3wp.exe should be treated as a likely compromise. This technique is vital for detecting active exploitation on servers before patches can be applied, or for identifying a compromise that may have occurred prior to patching.

CISA Adds SharePoint RCE CVE-2026-58644 to KEV Catalog