Microsoft SharePoint Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-58644, CWE-502)

1. Apply Official Security Patches

Immediately apply the official cumulative updates (CU) and security patches provided by Microsoft.

• Download and install the appropriate updates from the Microsoft MSRC Update Guide.

2. Temporary Mitigations (Prior to Patching)

If immediate patching is not feasible, implement the following workarounds:

• Network Segmentation: Restrict access to SharePoint web services and management ports (e.g., 80, 443) from the public internet using firewalls or VPNs.
• WAF (Web Application Firewall) Rules: Deploy WAF signatures to detect and block common .NET deserialization exploit payloads (e.g., patterns generated by ysoserial.net).
• Least Privilege Principle: Ensure that the SharePoint service accounts run with the minimum necessary privileges to limit the impact of a potential compromise.

This vulnerability (CVE-2026-58644) is a critical Remote Code Execution (RCE) vulnerability caused by the deserialization of untrusted data (CWE-502) within Microsoft SharePoint Server.

An unauthenticated attacker can exploit this vulnerability by sending a specially crafted serialized payload over the network to a vulnerable SharePoint server. This allows the attacker to execute arbitrary code in the context of the SharePoint service account without any user interaction or prior privileges (CVSS 3.1 Score: 9.8 Critical).

This vulnerability is actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog with an extremely high EPSS score of 0.94 (94%), indicating an imminent threat to unpatched systems.