CVE-2026-58644

criticalknown exploitedCVSS 9.8covered by 13 sourcesfirst seen 2026-07-14

Actively exploited. CVE-2026-58644 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-07-16) — exploitation has been observed in the wild, and US federal agencies are required to remediate it under BOD 22-01. Treat patching as urgent.

JPCERT-AT-2026-0020 JPCERT/CC 2026-07-15(Initial) 2026-07-31(Update) I. Overview Microsoft has released July 2026 Security Updates to address the vulnerabilities in their products. Attackers leveraging these vulnerabilities may be able to execute arbitrary code remotely without authentication, etc. Microsoft Corporation July 2026 Security Updates https://msrc.microsoft.com/update-guide/en-US/releaseNote/2026-Jul According to Microsoft, among the vulnerabilities, the following vulnerabilities have been confirmed to be exploited in the wild. Please refer to the latest information provided by Microsoft and implement the measures described in "II. Solution." CVE-2026-56164 Microsoft SharePoint Server Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56164 CVE-2026-56155 Active Directory Federation Services Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56155 Update: July 31, 2026 Update Microsoft has updated its advisory and stated that the remote code execution vulnerability in SharePoint (CVE-2026-58644), which was addressed in this month's security updates, has been exploited in the wild. CVE-2026-58644 Microsoft SharePoint Remote Code Execution Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644 In addition, another remote code execution vulnerability (CVE-2026-50522)has been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog.Information believed to include a proof-of-concept (PoC) exploit for this vulnerability has been published by a security researcher. Furthermore,watchTowr has reported observing attacks using the PoC exploit against its honeypots and published information indicating that machine keys were stolen from vulnerable SharePoint Server. CVE-2026-50522 Microsoft SharePoint Remote Code Execution Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522

CSIRTS triage

What: Vulnerabilities allow attackers to execute arbitrary code remotely without authentication.
Who is affected: Deployments of Microsoft SharePoint Server and Active Directory Federation Services.
Urgency: Remediation is urgent as these vulnerabilities are confirmed to be exploited in the wild.
Action: Implement the July 2026 Security Updates provided by Microsoft.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-58644

Get an email if CVE-2026-58644 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Exploitation confirmedAlready exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 93% of all EPSS-scored CVEs.

Advisory coverage (13)

unknownexploitedSecurity Alert: [Updated] Microsoft Releases July 2026 Security Updatesjpcert · 2026-07-31
criticalexploitedMicrosoft security advisory – July 2026 monthly rollup (AV26-698) – Update 3cccs · 2026-07-23
criticalexploited2026-009: Critical Vulnerabilities in Microsoft SharePointcert-eu · 2026-07-23
unknownexploitedMultiple vulnerabilities in Microsoft Sharepoint (July 22, 2026)cert-fr-alerte · 2026-07-22
unknownexploitedNCSC-2026-0237 [1.02] [H/H] Vulnerabilities Fixed in Microsoft Officencsc-nl · 2026-07-21
unknownexploitedNCSC-2026-0237 [1.01] [H/H] Vulnerabilities fixed in Microsoft Officencsc-nl · 2026-07-17
highexploitedCISA Adds Three Known Exploited Vulnerabilities to Catalogcisa · 2026-07-16
criticalexploitedCVE-2026-58644: Microsoft SharePoint Deserialization of Untrusted Data Vulnerabilitycisa-kev · 2026-07-16
criticalexploitedAL26-017 - Critical vulnerabilities impacting Microsoft SharePoint Server – CVE-2026-56164, CVE-2026-55040 and…cccs · 2026-07-15
unknownexploitedNCSC-2026-0237 [1.00] [M/H] Vulnerabilities fixed in Microsoft Officencsc-nl · 2026-07-14
criticalexploitedCVE-2026-58644: Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attack…nvd · 2026-07-14
unknownexploitedCISA Urges SharePoint Hardening After New Exploitationscisa · 2026-07-14
criticalexploitedCVE-2026-58644: Microsoft SharePoint Remote Code Execution Vulnerabilitymsrc · 2026-07-14

External references

NVD record for CVE-2026-58644

CVE.org record

CISA KEV catalog

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-58644 status](https://www.csirts.com/badge/CVE-2026-58644)](https://www.csirts.com/cve/CVE-2026-58644)