CVE-2026-58644

🗓️ 14 Jul 2026 17:05:37Reported by microsoftType

cve🔗 web.nvd.nist.gov📰️ 8 Media mentions👁 433 Views🌐 WEB

CVE-2026-58644: deserialization of untrusted data in Microsoft Office SharePoint enables remote code execution.

Reporter	Title	Published	Views	Family All 29
GithubExploit	sharepoint-2026-poc	26 Jul 202616:27	–	githubexploit
Information Security Automation	August "In the Trend of VM" (#30): vulnerabilities in ViPNet Client, the Microsoft Windows kernel, and Microsoft SharePoint	17 Aug 202615:00	–	avleonov
Information Security Automation	July Microsoft Patch Tuesday	26 Jul 202620:00	–	avleonov
Information Security Automation	About Remote Code Execution - Microsoft SharePoint (CVE-2026-58644) vulnerability	7 Aug 202620:00	–	avleonov
BDU FSTEC	The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server lies in their deserialization mechanism flaws, which allows attackers to execute arbitrary code.	17 Jul 202600:00	–	bdu_fstec
Circl	CVE-2026-58644	14 Jul 202619:00	–	circl
CISA KEV Catalog	Microsoft SharePoint Deserialization of Untrusted Data Vulnerability	16 Jul 202600:00	–	cisa_kev
Cvelist	CVE-2026-58644 Microsoft SharePoint Remote Code Execution Vulnerability	14 Jul 202617:05	–	cvelist
EUVD	EUVD-2026-43779	14 Jul 202618:32	–	euvd
Microsoft KB	Description of the security update for SharePoint Server Subscription Edition: June 9, 2026 (KB5002873)	14 Jul 202614:00	–	mskb

NVD

Vulners

CNA

Node

microsoft sharepoint_serverRange<16.0.19725.20434subscription

microsoft sharepoint_serverMatch2016enterprise

microsoft sharepoint_serverMatch2019

[
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Enterprise Server 2016",
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "16.0.5556.1005",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Server 2019",
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "16.0.10417.20153",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Server Subscription Edition",
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "16.0.19725.20384",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]

Source	Link
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
wresult	request body	/_trust/default.aspx	WS-Federation sign-in endpoint deserialization payload carrying a base64, DEFLATE-compressed BinaryFormatter stream in the wresult parameter, leading to remote code execution.	CWE-502

25 Sep 2026 18:20Current

7.8High risk

Vulners AI Score7.8

CVSS 3.19.8

EPSS0.15873

SSVC