A previously unknown deserialization vulnerability in Microsoft SharePoint Server was being actively exploited in the wild before Microsoft disclosed and patched it as part of the July 14, 2026 Patch Tuesday cycle. The flaw, assigned CVE-2026-58644 with a CVSS score of 9.8, allows an unauthenticated remote attacker to execute arbitrary code on affected SharePoint servers. CISA added it to the Known Exploited Vulnerabilities catalog on July 16, with a July 19 remediation deadline for Federal Civilian Executive Branch agencies.
The Exploitation Chain
CVE-2026-58644 is not being exploited in isolation. CISA has confirmed that threat actors are combining it with three additional SharePoint vulnerabilities in a coordinated post-exploitation sequence:
- CVE-2026-32201 — an information disclosure flaw used for initial reconnaissance
- CVE-2026-45659 — a previously known RCE vulnerability that some organisations may still have unpatched (covered in prior Adversary Wire reporting)
- CVE-2026-56164 — a privilege escalation flaw chained after initial access
Together the four CVEs enable attackers to gain unauthenticated initial access, escalate privileges, achieve persistent code execution, and move laterally within SharePoint-connected environments. The chain represents a maturation of SharePoint-targeted tradecraft that has been developing throughout the first half of 2026.
Persistence via IIS Machine Key Theft
The persistence mechanism is significant. Once inside a SharePoint environment, attackers are stealing Internet Information Services (IIS) machine keys, the symmetric keys used by ASP.NET to sign and encrypt session tokens, view state, and authentication tickets. With a harvested machine key, an attacker can forge tokens that are trusted by any application on the same IIS instance indefinitely, persisting access even after passwords are reset or patches are applied. The technique is well-documented and has been used by state-sponsored actors in prior SharePoint campaigns, suggesting operational familiarity.
Microsoft has confirmed exploitation of this technique alongside CVE-2026-58644, and CISA guidance specifically calls out the need to rotate or regenerate IIS machine keys as part of incident response for any organisation that suspects exposure.
Sector Impact
SharePoint Server is embedded across enterprise, government, healthcare, and financial services environments. The on-premises deployment models affected by CVE-2026-58644 (SharePoint 2016, 2019, and Subscription Edition) remain common in regulated industries with data residency or compliance constraints that have delayed cloud migration. Organisations in these sectors relying on legacy SharePoint deployments are most exposed.
The DHS Homeland Security Information Network, breached in late May 2026 via a SharePoint environment, illustrates how SharePoint compromise extends beyond individual organisations to shared inter-agency platforms. While that intrusion predates CVE-2026-58644’s disclosure, the attack surface is the same.
Recommended Actions
Immediate (within 24-72 hours):
- Apply Microsoft’s July 14, 2026 Patch Tuesday updates to all SharePoint Server instances
- Check CISA’s advisory for indicators of compromise and AMSI detection signatures
- Rotate IIS machine keys on all SharePoint servers, even those already patched, as machine key theft provides persistence that survives patching
Short term (within 7 days):
- Audit SharePoint exposure: remove any SharePoint Central Administration interfaces accessible from the internet
- Review SharePoint access logs for evidence of the exploitation chain using the CVE-2026-32201 information disclosure probe as a precursor indicator
- Enable Microsoft Defender’s AMSI integration and configure alerting on suspicious SharePoint process trees
If compromise is suspected: Assume IIS machine keys are compromised and invalidate all active SharePoint sessions. Engage incident response before returning the environment to production, as the machine key theft technique provides attackers durable access that standard remediation steps may miss.
SharePoint environments that have not applied the July 14 patches remain exposed to unauthenticated exploitation of a public zero-day with a working chain confirmed in the wild.