CISA Adds Exploited Share Point RCE Zero-Day CVE-2026-58644 to KEV
Summary: CISA added CVE-2026-58644, a critical deserialization of untrusted data flaw in Microsoft SharePoint Server with a CVSS score of 9.8, to its Known Exploited Vulnerabilities catalog on Thursday, requiring Federal Civilian Executive Branch agencies to apply fixes by July 19, 2026. Microsoft revised its bulletin to confirm the flaw was exploited in the wild as a zero-day before patches shipped in the July 14, 2026 Patch Tuesday updates, and CISA also warned of active exploitation of CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 affecting all supported on-premises SharePoint Server versions.
Key Takeaway: An attacker authenticated as at least a Site Owner can write and execute arbitrary code remotely on the SharePoint Server, and CISA says these flaws are being used to steal IIS machine keys and deploy malware for persistence across Subscription Edition, 2019, and 2016 on-premises instances.