CISA Adds Actively Exploited SharePoint Zero-Day CVE-2026-58644 to Known Exploited Vulnerabilities Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a newly patched critical Microsoft SharePoint Server vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming it was weaponized in the wild before a patch was available. Federal civilian agencies have been given until July 19, 2026 to apply the necessary fixes. What the Vulnerability Does? Tracked as CVE-2026-58644 with a near-maximum CVSS score of 9.8, the flaw is a deserialization of untrusted data vulnerability that enables remote code execution on affected SharePoint Server installations. An attacker who has been authenticated with at least Site Owner permissions can inject and execute arbitrary code directly on the server over a network connection. Microsoft highlighted two factors that make this vulnerability particularly dangerous: attackers do not need deep prior knowledge of the targeted system, and the exploit can be reliably repeated against vulnerable instances. The vulnerabil...