Critical alert: CVE-2026-58644 in SharePoint on-premises already exploited, mandatory patch and mitigation guide

The United States Agency for Infrastructure and Cybersecurity ( CISA) has placed critical vulnerability CVE-2026-58644 in its catalogue of known and exploited vulnerabilities (KEV), with the obligation for federal agencies to apply patches before 19 July 2026. Microsoft posted the corrections within the Patch Tuesday of 14 July 2026 Technically, the failure has a CVSS score of 9.8 and is especially dangerous for two reasons: operating complexity is low and the attacker does not need a deep knowledge of the environment to achieve repeatable results. It affects the on-premises versions of SharePoint Server (Subscription Edition, 2019 and 2016), and adds to other SharePoint vulnerabilities that CISA has reported as actively exploited, expanding the risk for local bodies that are exposed or poorly segmented. The fact that CISA has included this CVE in its KEV catalogue implies an operational mandate for federal agencies and an alarm signal for the other organizations: when vulnerability appears in KEV it usually means that the real risk is imminent and that the attackers are already using it for intrusions, exfiltration and persistence establishment. In addition to CVE-2026-58644, the agency has drawn attention to other failures in SharePoint and, in parallel, added critical vulnerabilities of Fortinet FortiSandbox to the catalogue, which shows that the active exploitation landscape is wide and multifaceted. You can check the CISA register in your KEV catalog to confirm the dates and details: CVE-2026-58644 in the CISA KEV catalogue. If SharePoint on-premises is managed, the first actions must be immediate: apply the official patches published by Microsoft and verify their correct installation on all farm servers. Microsoft maintains an update guide and the corresponding security input where patches and mitigation are described; review it helps to understand which components are corrected and which additional steps are recommended: Microsoft Security Notice for CVE-2026-58644. It is important to insist that SharePoint Online is not on account of the on-premises administrator, so the implications and responsibilities are different between the cloud and local servers. Beyond applying patches, CISA and Microsoft recommend a series of concrete reinforcements: enable integration with Antimalware Scan Interface (AMSI) in each SharePoint web application, search and clean intrusion devices before rotating IIS keys (to prevent them from being attacked and reused), limit the exposure of servers to the Internet and block external access to SharePoint Central Administration. It's also critical. review telemetry(IIS log, SharePoint and security event records, unusual outgoing traffic) to detect useful loads, web shells or side movements, and to preserve evidence before making changes that can destroy forensic indicators. For IT response and leadership teams, the strategic recommendation is clear: to assume a "fast patch, verify faster" model. This means shortening parking cycles when it comes to critical failures, automating deployments and verifications, having proven backup and recovery plans, and, if possible, applying network segmentation and access controls that reduce the blast radius in case of operation. If you detect signs of commitment, activate container and forensic procedures, consider the rotation of affected keys and passwords, and, where appropriate, notify the relevant authorities and their security providers. Finally, for non-federal organizations the lesson is practical: do not wait for a vulnerability to appear in an official catalogue to prioritize it. The combination of active exploits, low attack complexity and post-exploitation capabilities (such as machine keys theft and deserialization persistence) makes these vulnerabilities highly lucrative intrusion vectors for attackers. Blinding the entry points, maintaining process of patching and visibility in production is the most effective defense today. For more details on hardening and best practices of SharePoint Server, see the official Microsoft security documentation for SharePoint Server: SharePoint Server security guide in Microsoft Learn.

Technically, the failure has a CVSS score of 9.8 and is especially dangerous for two reasons: operating complexity is low and the attacker does not need a deep knowledge of the environment to achieve repeatable results. It affects the on-premises versions of SharePoint Server (Subscription Edition, 2019 and 2016), and adds to other SharePoint vulnerabilities that CISA has reported as actively exploited, expanding the risk for local bodies that are exposed or poorly segmented.

The fact that CISA has included this CVE in its KEV catalogue implies an operational mandate for federal agencies and an alarm signal for the other organizations: when vulnerability appears in KEV it usually means that the real risk is imminent and that the attackers are already using it for intrusions, exfiltration and persistence establishment. In addition to CVE-2026-58644, the agency has drawn attention to other failures in SharePoint and, in parallel, added critical vulnerabilities of Fortinet FortiSandbox to the catalogue, which shows that the active exploitation landscape is wide and multifaceted. You can check the CISA register in your KEV catalog to confirm the dates and details: CVE-2026-58644 in the CISA KEV catalogue.

If SharePoint on-premises is managed, the first actions must be immediate: apply the official patches published by Microsoft and verify their correct installation on all farm servers. Microsoft maintains an update guide and the corresponding security input where patches and mitigation are described; review it helps to understand which components are corrected and which additional steps are recommended: Microsoft Security Notice for CVE-2026-58644. It is important to insist that SharePoint Online is not on account of the on-premises administrator, so the implications and responsibilities are different between the cloud and local servers.

Beyond applying patches, CISA and Microsoft recommend a series of concrete reinforcements: enable integration with Antimalware Scan Interface (AMSI) in each SharePoint web application, search and clean intrusion devices before rotating IIS keys (to prevent them from being attacked and reused), limit the exposure of servers to the Internet and block external access to SharePoint Central Administration. It's also critical. review telemetry(IIS log, SharePoint and security event records, unusual outgoing traffic) to detect useful loads, web shells or side movements, and to preserve evidence before making changes that can destroy forensic indicators.

For IT response and leadership teams, the strategic recommendation is clear: to assume a "fast patch, verify faster" model. This means shortening parking cycles when it comes to critical failures, automating deployments and verifications, having proven backup and recovery plans, and, if possible, applying network segmentation and access controls that reduce the blast radius in case of operation. If you detect signs of commitment, activate container and forensic procedures, consider the rotation of affected keys and passwords, and, where appropriate, notify the relevant authorities and their security providers.

Finally, for non-federal organizations the lesson is practical: do not wait for a vulnerability to appear in an official catalogue to prioritize it. The combination of active exploits, low attack complexity and post-exploitation capabilities (such as machine keys theft and deserialization persistence) makes these vulnerabilities highly lucrative intrusion vectors for attackers. Blinding the entry points, maintaining process of patching and visibility in production is the most effective defense today. For more details on hardening and best practices of SharePoint Server, see the official Microsoft security documentation for SharePoint Server: SharePoint Server security guide in Microsoft Learn.