- Vulnerability Quick Reference
- What Is a Deserialization Vulnerability?
- Affected Products
- The Full Attack Chain: Four CVEs, One Exploitation Path
- The Broader Campaign: All Four CVEs
- Indicators of Compromise (IOCs)
- Step-by-Step Remediation (Sequence Matters)
- Exploitation Timeline
- Key Takeaways
- Frequently Asked Questions
- Conclusion
- Sources
On July 14, 2026, Microsoft released one of the most consequential Patch Tuesday updates in recent memory — a record-breaking 570 security fixes. Among them was a critical SharePoint Server vulnerability confirmed exploited in the wild before a patch existed: CVE-2026-58644 (CVSS 9.8), a deserialization zero-day giving authenticated attackers direct remote code execution on SharePoint Server. Two days after disclosure, CISA added it to its Known Exploited Vulnerabilities catalog alongside a broader alert documenting an active four-CVE campaign targeting on-premises SharePoint deployments.
This article provides the complete technical breakdown: vulnerability mechanics, full attack chain, detection signatures, indicators of compromise, and the exact remediation sequence your security team must follow.
Vulnerability Quick Reference
| Attribute | Details |
|---|---|
| CVE Number | CVE-2026-58644 |
| CVSS Score | 9.8 (Critical) |
| Vulnerability Type | Deserialization of Untrusted Data (CWE-502) |
| Attack Vector | Network — Remote |
| Attack Complexity | Low |
| Privileges Required | Low (Site Owner minimum) |
| Affected Versions | SharePoint Server 2016, 2019, Subscription Edition (on-premises only) |
| Exploitation Status | Zero-day — exploited before patch release |
| Patch Released | July 14, 2026 (Patch Tuesday) |
| CISA KEV Added | July 16, 2026 |
| Federal Patch Deadline | July 19, 2026 (BOD 26-04) |
What Is a Deserialization Vulnerability?
Serialization converts software objects into a transmittable byte string. Deserialization reverses the process. A deserialization vulnerability (CWE-502) occurs when an application deserializes data without validating whether it is trustworthy — allowing an attacker to craft malicious serialized data that executes attacker-controlled code when the server processes it.
In SharePoint, this execution happens inside the IIS worker process (w3wp.exe), which runs with elevated system privileges. The result is arbitrary code execution with IIS application pool identity rights — effectively full control of the SharePoint server. Microsoft noted that this flaw requires no deep knowledge of the target and can be exploited repeatably, making automated large-scale exploitation realistic.
Affected Products
SharePoint Online (Microsoft 365) is not affected. Only on-premises installations are vulnerable:
- Microsoft SharePoint Server Subscription Edition (builds before July 2026 Cumulative Update)
- Microsoft SharePoint Server 2019 (builds before July 2026 Cumulative Update)
- Microsoft SharePoint Enterprise Server 2016 (builds before July 2026 Security Update)
SharePoint Server 2013 is end-of-life and will not receive a patch. Organizations still running it should isolate or migrate immediately.
The Full Attack Chain: Four CVEs, One Exploitation Path
CISA alert, corroborated by Tenable, Vulert, and independent researchers, documents a four-stage attack chain chaining multiple CVEs into a single exploitation path executable in one session. Patching CVE-2026-58644 alone does not mean your organization was not already compromised through earlier stages.
Stage 1: Authentication Bypass (CVE-2026-32201 and CVE-2026-45659)
Attackers begin with authentication bypass flaws allowing unauthenticated access to SharePoint endpoints that should require credentials. Internet-facing SharePoint servers with exposed Central Administration are primary targets. Once inside through bypass, attackers proceed to code execution.
Stage 2: Remote Code Execution (CVE-2026-56164 and CVE-2026-58644)
With authenticated access established, attackers send specially crafted serialized payloads. The server deserializes the malicious data and executes embedded code within the IIS worker process. Researchers documented that in observed attacks, threat actors deploy ASP.NET web shells — specifically spinstall0.aspx — to the SharePoint file system for persistent HTTP-accessible command execution.
Stage 3: IIS Machine Key Theft
The most technically sophisticated post-exploitation step involves extracting ASP.NET machine keys from SharePoint server configuration. Machine keys are cryptographic secrets IIS uses to sign and authenticate session tokens and view state data. With these keys, an attacker can forge any request to appear legitimately signed by the server, granting persistence that survives password resets and account lockouts. CISA specifically named the Defender signature Backdoor:MSIL/LeakFang.A!dha as the indicator of this harvesting activity.
⚠ Critical Sequencing Warning: Scan for and remove machine key harvesting tools before rotating IIS machine keys. If tools remain when keys are rotated, attackers capture the new keys immediately. Rotation without prior cleanup provides false security and a missed opportunity to actually cut off attacker access.
Stage 4: Persistence and Lateral Movement
With machine keys extracted and a web shell present, attackers use stolen keys to forge deserialization requests maintaining code execution even after web shell removal. The SharePoint server becomes a persistent attacker-controlled foothold with access to all SharePoint data, cached credentials, Active Directory, connected SQL databases, and any network resource the SharePoint service account can reach.
The Broader Campaign: All Four CVEs
| CVE | CVSS | Type | Status |
|---|---|---|---|
| CVE-2026-32201 | Critical | Authentication Bypass / RCE | Actively Exploited |
| CVE-2026-45659 | Critical | Authentication Bypass | Actively Exploited |
| CVE-2026-56164 | 5.3 | Privilege Escalation / Missing Auth | Actively Exploited |
| CVE-2026-58644 | 9.8 | Deserialization RCE (Zero-Day) | Zero-Day / CISA KEV |
Apply all four patches simultaneously. These vulnerabilities form a single attack path, not four separate issues.
Indicators of Compromise (IOCs)
Microsoft Defender and AMSI Detection Signatures
AMSI: Exploit:Script/SuspSignoutReqBody.A— Suspicious request body; SharePoint Subscription Edition onlyAMSI: Exploit:Script/ToolPaneAuthBypass.A— Auth bypass via request header manipulation; all supported versionsAMSI: Exploit:Script/ToolPaneAuthBypass.C— RCE detection coverage; all supported versionsMDAV: Backdoor:MSIL/LeakFang.A!dha— Post-exploitation IIS machine key theft activity (treat any detection as critical)
File System Indicators
- Unexpected
.aspxfiles in SharePoint web application directories, especiallyspinstall0.aspx - New or modified files under
C:inetpubwwwrootwssVirtualDirectories - Machine key harvesting scripts or tools on any SharePoint server
- Unauthorized DLLs loaded into
w3wp.exe
Process and Log Indicators
- IIS logs: anomalous HTTP POST requests to SharePoint endpoints from unexpected IPs or geolocations
- Process tree:
w3wp.exespawningcmd.exe,powershell.exe,net.exe,whoami.exe, ornltest.exe - SharePoint ULS logs: deserialization errors or unexpected serialization activity
- Windows Security Event Log: authentication events (4624, 4625, 4648) at unusual times on SharePoint servers
Step-by-Step Remediation (Sequence Matters)
Step 1: Inventory Every On-Premises SharePoint Instance
Identify every SharePoint farm including development, test, and staging environments. Many organizations have forgotten SharePoint instances still internet-accessible. Check asset management records, DNS, and internal network scans before proceeding.
Step 2: Isolate Internet-Facing Servers You Cannot Immediately Patch
Remove external access temporarily for any SharePoint server you cannot patch within hours. CISA explicitly recommends SharePoint Central Administration never be accessible from the public internet under any circumstances.
Step 3: Apply July 2026 Updates to Every Farm Node
Install the July 14, 2026 Cumulative Updates for your SharePoint version on every server. After installing the Windows update package, complete the SharePoint Products Configuration Wizard on every farm node. The wizard is mandatory — skipping it leaves some SharePoint components unprotected. Verify the patch:
# Run from SharePoint Management Shell on each node
(Get-SPFarm).BuildVersionStep 4: Enable AMSI Integration
Enable Antimalware Scan Interface (AMSI) for each SharePoint web application. This allows Microsoft Defender to scan request bodies and headers before SharePoint processes them, providing detection capability against novel payloads.
Step 5: Hunt for Intrusion Artifacts Before Rotating Keys
Before rotating machine keys, thoroughly scan for web shell files, machine key harvesting tools, unauthorized DLLs in IIS application pools, and unexpected scheduled tasks or service accounts created during the exposure window. If you find evidence of compromise, activate your incident response plan before proceeding with remediation.
Step 6: Rotate IIS Machine Keys After Cleanup Is Confirmed
Only after Step 5 is complete should you rotate IIS machine keys. Follow Microsoft guidance on ASP.NET view state security. After rotation, validate SharePoint applications function correctly.
Step 7: Establish Enhanced Logging
Configure IIS access logging, SharePoint ULS verbose logging, and Windows Event Log collection into your SIEM platform. Enable Sysmon process creation logging targeting w3wp.exe child processes on all SharePoint servers.
💡 Hunting Timeline Note: Begin log analysis before July 14, 2026. CVE-2026-58644 was exploited as a zero-day before the patch release. An investigation starting from patch day will miss the initial compromise window.
Exploitation Timeline
- Before July 14, 2026: CVE-2026-58644 exploited as an unpatched zero-day
- July 14, 2026: Microsoft Patch Tuesday releases 570 fixes; CISA adds three SharePoint CVEs to KEV and issues hardening alert
- July 15, 2026: Microsoft updates advisory confirming CVE-2026-58644 exploited in the wild
- July 16, 2026: CISA adds CVE-2026-58644 to KEV; federal three-day patch deadline issued
- July 17, 2026: Independent researchers publish complete attack chain analysis with web shell and IOC details
- July 19, 2026: Federal Civilian Executive Branch mandatory patch deadline (BOD 26-04)
Key Takeaways
- 🚨 CVE-2026-58644 is a CVSS 9.8 deserialization zero-day exploited before a patch existed
- 🛡 All supported on-premises SharePoint versions affected; SharePoint Online is not
- ⚡ Four-CVE attack chain: auth bypass, RCE, IIS machine key theft, persistent web shell
- 🔎 Key IOCs:
Backdoor:MSIL/LeakFang.A!dha,spinstall0.aspx, unexpectedw3wp.exechild processes - ⚠ Remove ALL artifacts before rotating IIS machine keys — rotation without cleanup enables immediate re-theft
- ✅ Patch Tuesday update → Configuration Wizard on all nodes → Enable AMSI → Hunt for artifacts → Rotate keys → Enhanced logging
- 📅 Threat hunting scope begins before July 14, 2026
Frequently Asked Questions
Does CVE-2026-58644 affect SharePoint Online (Microsoft 365)?
No. CVE-2026-58644 only affects on-premises SharePoint Server (2016, 2019, Subscription Edition). SharePoint Online is managed and patched by Microsoft and is not vulnerable to this flaw. Organizations using only SharePoint Online do not need to take action for this CVE.
What privileges does an attacker need to exploit CVE-2026-58644?
CVE-2026-58644 requires Site Owner permissions at minimum. However, the active campaign chains it with authentication bypass vulnerabilities (CVE-2026-32201, CVE-2026-45659) that can eliminate the credential requirement. Do not treat the authentication requirement as a complete barrier.
Why must I hunt for intrusion artifacts before rotating IIS machine keys?
If machine key harvesting tools remain on the server when keys are rotated, attackers capture the replacement keys immediately. Rotating keys without prior cleanup creates false security. Always remove all web shells and harvesting tools before rotating machine keys.
How do I verify July 2026 SharePoint patches applied successfully?
Run (Get-SPFarm).BuildVersion from SharePoint Management Shell on every farm node and verify the build number matches Microsoft published July 2026 thresholds for your version. The SharePoint Products Configuration Wizard must also complete successfully on every node — installer exit code alone is insufficient verification.
Is this SharePoint campaign linked to a specific ransomware group?
CISA has not publicly attributed this campaign to a specific threat actor or ransomware group as of July 2026. The observed post-exploitation techniques — machine key theft, web shell deployment, persistence — are consistent with both ransomware pre-staging and nation-state long-term espionage operations. Deserialization vulnerabilities have historically been favored by both categories of threat actors.
Conclusion
CVE-2026-58644 is one of the most urgent SharePoint vulnerabilities in recent years. Its exploitation as a zero-day before a patch existed, its near-perfect CVSS score, and its role as the final stage in a four-CVE attack chain combine to make this the highest security priority for any organization running SharePoint on-premises.
The campaign CISA documented is sophisticated and targeted. Threat actors are extracting machine keys, deploying persistent web shells, and positioning for long-term access inside enterprise collaboration infrastructure. Organizations most at risk have internet-facing SharePoint deployments, minimal IIS logging, and patch cycles that lag the critical response window CISA mandated.
Patch. Hunt for artifacts before rotating keys. Enable AMSI. Monitor IIS logs. And if there is any doubt about whether your environment was compromised before July 14, 2026, activate your incident response playbook now.
✓ Bottom line: Treat this as an active incident investigation first and a patch deployment second. The patch closes the door. The forensic investigation tells you whether someone was already inside before it closed.
Sources
- CISA: CISA Urges SharePoint Hardening After New Exploitations — July 14, 2026
- BleepingComputer: Microsoft July 2026 Patch Tuesday — Record 570 Flaws, 3 Zero-Days — July 14, 2026
- The Hacker News: CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV — July 17, 2026
- CrowdStrike: July 2026 Patch Tuesday Analysis — July 14, 2026
- Tenable Research: SharePoint CVEs FAQ — Active Exploitation — July 2026
- SecurityWeek: Fresh SharePoint Vulnerability Exploited Soon After Disclosure — July 2026
- Vulert: CISA SharePoint CVE-2026-58644 KEV Analysis — July 2026
- GBHackers: One Malicious Web Request Can Turn a SharePoint Server Into a Persistent Backdoor — July 2026
