Microsoft has confirmed active exploitation of a critical remote code execution (RCE) vulnerability, CVE-2026-58644, affecting on-premises deployments of its SharePoint Server. The vulnerability, which stems from the deserialization of untrusted data (CWE-502), allows an unauthenticated attacker to execute arbitrary code with a CVSS v3.1 score of 9.8 (Critical).
The security advisory addressing CVE-2026-58644 was published by Microsoft on July 14, 2026, coinciding with the release of security updates. Following Microsoft's confirmation of in-the-wild exploitation, the vulnerability was added to the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog on July 16, 2026.
CISA has issued guidance urging organizations to immediately apply Microsoft’s security updates. Additionally, CISA recommends leveraging Microsoft Defender and Antimalware Scan Interface (AMSI) detections to identify any ongoing exploitation attempts.
The affected products include Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition.
Microsoft's recommendations for mitigation prioritize emergency remediation for organizations operating affected on-premises SharePoint Server deployments. These steps include applying the July 14, 2026 security updates for all relevant SharePoint versions and verifying their successful installation across all SharePoint servers.
Organizations are also advised to ensure that AMSI integration is enabled for every SharePoint web application. Monitoring Microsoft Defender and AMSI detections for indicators of attempted exploitation is crucial, and incident response procedures should be initiated if any exploitation artifacts are detected.
Microsoft and CISA have highlighted specific security detections associated with observed SharePoint exploitation activity. These include AMSI/Microsoft Defender detections such as "Exploit:Script/SuspSignoutReqBody.A" for request body scanning, which Microsoft reports is blocking observed exploitation attempts on SharePoint Server Subscription Edition.
Another detection is "Exploit:Script/ToolPaneAuthBypass.A" for request header scanning, applicable to SharePoint Server 2016, SharePoint Server 2019, and Subscription Edition. A related detection, "Exploit:Script/ToolPaneAuthBypass," is also noted.
As of the latest reports, no public IP addresses, domains, URLs, or additional network-based indicators of compromise have been widely disclosed. Administrators are encouraged to consult Microsoft’s official advisory for the most current remediation guidance and update availability.
Vulnerability management solutions, such as Exposure Command, InsightVM, and Nexpose, have provided authenticated vulnerability checks for CVE-2026-58644 since their content release on July 14.
