CISA Adds Actively Exploited SharePoint Zero-Day CVE-2026-58644 to Known Exploited Vulnerabilities Catalog

-

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a newly patched critical Microsoft SharePoint Server vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming it was weaponized in the wild before a patch was available. Federal civilian agencies have been given until July 19, 2026 to apply the necessary fixes.


What the Vulnerability Does?

Tracked as CVE-2026-58644 with a near-maximum CVSS score of 9.8, the flaw is a deserialization of untrusted data vulnerability that enables remote code execution on affected SharePoint Server installations. An attacker who has been authenticated with at least Site Owner permissions can inject and execute arbitrary code directly on the server over a network connection.

Microsoft highlighted two factors that make this vulnerability particularly dangerous: attackers do not need deep prior knowledge of the targeted system, and the exploit can be reliably repeated against vulnerable instances. The vulnerability affects all currently supported on-premises versions of SharePoint, including SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.

A patch was released as part of Microsoft's July 2026 Patch Tuesday update on July 14. Microsoft subsequently revised its advisory to confirm the vulnerability had already been exploited in the wild as a zero-day before the patch was made available.

Broader SharePoint Threat Landscape

The KEV addition comes alongside a broader CISA warning about a surge in active exploitation targeting on-premises SharePoint Server deployments. Beyond CVE-2026-58644, attackers have also been observed exploiting CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164, a cluster of vulnerabilities that collectively enable remote code execution and a range of post-exploitation techniques.

CISA noted that threat actors are specifically abusing these flaws to steal Internet Information Services (IIS) machine keys and perform deserialization attacks, allowing them to gain persistence and deploy malware on compromised servers.

Hardening Recommendations

CISA outlined a series of concrete steps organizations should take to reduce their exposure. These include applying the latest Microsoft patches and verifying their successful installation, enabling Antimalware Scan Interface (AMSI) integration for each SharePoint web application, scanning for and removing any intrusion artifacts before rotating IIS machine keys to prevent credential theft, and establishing tailored logging to detect exploitation activity.

On the network side, CISA strongly advises against exposing SharePoint Servers directly to the internet unless absolutely necessary, blocking external access to SharePoint Central Administration, and restricting farm and database communications to only the systems that require them.

Also: Two Fortinet FortiSandbox Flaws Added to KEV

In the same advisory update, CISA also added two critical vulnerabilities in Fortinet FortiSandbox CVE-2026-25089 and CVE-2026-39808 to the KEV catalog following reports of active exploitation. Federal agencies face the same July 19, 2026 deadline to update their FortiSandbox installations to the latest supported versions.

References

Comments

Post a Comment

Popular posts from this blog

Hackers Exploit MinIO Storage System Vulnerabilities to Compromise Servers

-
Image
An unknown threat actor has been observed weaponizing high-severity security flaws in the MinIO high-performance object storage system to achieve unauthorized code execution on affected servers. Cybersecurity and incident response firm Security Joes said the intrusion leveraged a publicly available exploit chain to backdoor the MinIO instance. The comprises  CVE-2023-28432  (CVSS score: 7.5) and  CVE-2023-28434  (CVSS score: 8.8), the former of which was added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog on April 21, 2023. The two vulnerabilities "possess the potential to expose sensitive information present within the compromised installation and facilitate remote code execution (RCE) on the host where the MinIO application is operational," Security Joes said in a report shared with The Hacker News. In the attack chain investigated by the company, the flaws are said to have be...
Read more

Critical Vulnerability in Veeam Backup & Replication Exposes Enterprises to Remote Code Execution

-
Image
Critical Vulnerability in Veeam Backup & Replication Exposes Enterprises to Remote Code Execution By : Rei Ibraima A newly discovered critical vulnerability in Veeam’s Backup & Replication software, designated as CVE-2025-23120, poses a significant security risk to enterprise environments. The flaw allows authenticated domain users to execute arbitrary code remotely, potentially leading to full compromise of backup infrastructures. About CVE-2025-23120 The vulnerability arises from an insecure deserialization issue within Veeam Backup & Replication components—particularly in the .NET classes Veeam.Backup.EsxManager.xmlFrameworkDs and Veeam.Backup.Core.BackupSummary. Improper input validation in these components allows attackers to inject malicious serialized objects that are executed on the server side, resulting in Remote Code Execution (RCE). This issue affects systems where Veeam Backup & Replication is deployed in a domain-joined configuration, which—while common—is...
Read more

The Hidden Lag Killing Your SIEM Efficiency

-
Image
  If your security tools feel slower than they should, you’re not imagining it. Many IT teams blame their sluggish SIEM performance on query complexity or alert volume. But sometimes the real issue is much simpler: oversized input files quietly dragging your system down. Think about the last time you had to sift through a bloated PDF or an unoptimised log dump. Every unnecessary megabyte adds strain. Every redundant line eats up cycles. Your SIEM doesn’t just react to threats—it processes all incoming data, relevant or not. When it starts lagging, detection gets delayed, triage slows, and in the high-stakes world of threat response, even seconds count. We often focus on analytics and rule tuning, but upstream efficiency—what you feed into your system—deserves just as much attention. This article looks at how optimising your inputs unlocks downstream performance. Why Oversized Files Clog the Pipeline As data volumes grow, organisations face esca lating  data storage costs ,...
Read more