SharePoint CVE-2026-58644 is exploited; admins face a July 19 deadline

Administrators running on-premises Microsoft SharePoint Server have an active-exploitation deadline, not a routine Patch Tuesday item. NVD lists CVE-2026-58644 as a Microsoft Office SharePoint deserialization vulnerability that can allow code execution over the network, and its record now points to CISA's Known Exploited Vulnerabilities catalog.

The risk is concentrated in supported on-premises SharePoint Server versions, not a generic Microsoft 365 cloud warning. The operational priority is straightforward: identify exposed SharePoint servers, apply Microsoft's July security updates, verify installation, and inspect for signs of exploitation before assuming the environment is clean.

CVE-2026-58644 is now in the exploited lane

NVD describes CVE-2026-58644 as deserialization of untrusted data in Microsoft Office SharePoint that allows an unauthorized attacker to execute code over a network. The record includes the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which maps to a critical network-reachable issue with low attack complexity and high confidentiality, integrity, and availability impact.

The same NVD entry includes CISA ADP data marking exploitation as active, automatable as yes, and technical impact as total. That combination is why this belongs in the urgent patch lane. It is not merely a theoretical bug with a high base score.

Rapid7's emergency threat response writeup corroborates the timing: Microsoft published the advisory on July 14, 2026, and CISA added the vulnerability to KEV on July 16. The Hacker News also reports CISA's July 19 deadline for U.S. Federal Civilian Executive Branch agencies.

Affected SharePoint versions and patch floors

The affected configurations in NVD include Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition. NVD lists affected version floors as:

Version checks should be done on every SharePoint server in the farm. A single patched node does not protect a farm if another internet-reachable node remains behind.

Hardening goes beyond installing the update

The patch is the first step, not the whole response. CISA's SharePoint hardening guidance, as summarized by independent security coverage, points administrators toward enabling Antimalware Scan Interface integration for each SharePoint web application, scanning for intrusion artifacts, and removing malicious tooling before rotating IIS machine keys.

That sequence matters. If keys are rotated while attacker artifacts remain in place, the environment can be re-compromised or persistence can survive longer than the patch window suggests. Teams should also review external exposure, block direct internet access where it is not required, restrict SharePoint Central Administration, and narrow farm/database communications to expected systems.

For organizations that manage vulnerability intake through tooling, this is a good candidate for a short emergency workflow: asset query, version verification, patch proof, AMSI status, exposure review, evidence capture, and incident-response escalation when artifacts appear.

What LinkLoot readers should do today

Treat CVE-2026-58644 as an emergency check for any on-premises SharePoint estate. Cloud-only SharePoint users should still read tenant security notices, but the cited CVE scope is SharePoint Server. Managed service providers and internal IT teams should prioritize customers with public-facing SharePoint, extranet portals, complex add-ins, or slow monthly maintenance cycles.

Document the decision either way. A clean note saying "no on-premises SharePoint Server exists" is useful. A clean note saying "SharePoint exists, patched to these builds, AMSI enabled, no known exposure" is better. A missing note becomes a problem if later telemetry shows attempted exploitation.

Evidence

This article uses NVD's CVE record as the primary source because the direct CISA alert page was not consistently fetchable during this run. The NVD record links to Microsoft's advisory and CISA's KEV catalog entry, and independent coverage from Rapid7 and The Hacker News corroborates active exploitation, affected on-premises SharePoint versions, and remediation urgency.