CVE-2026-58644: Microsoft SharePoint Deserialization RCE

Overview

CVE-2026-58644 is a critical deserialization of untrusted data vulnerability affecting Microsoft SharePoint Server. This flaw allows an unauthenticated attacker to execute arbitrary code remotely over the network. Given its high severity (CVSS 9.8) and potential for complete system compromise without user interaction, this vulnerability poses a significant risk to organizations utilizing vulnerable SharePoint deployments.

Technical Analysis

The vulnerability, categorized as CWE-502 (Deserialization of Untrusted Data), resides within Microsoft SharePoint. An attacker can craft malicious serialized data and send it to a vulnerable SharePoint instance. When the SharePoint application attempts to deserialize this untrusted data, it can lead to the execution of arbitrary code in the context of the SharePoint server process. This attack does not require authentication or user interaction, making it highly impactful.

• Vulnerability Type: Deserialization of Untrusted Data (CWE-502)
• Affected Products:
  • Microsoft SharePoint Server < 16.0.19725.20434
  • Microsoft SharePoint Server 2016
  • Microsoft SharePoint Server 2019
• Attack Vector: Network (AV:N)
• Authentication: Not required (PR:N)
• User Interaction: Not required (UI:N)
• Impact: Complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H)

Detection

Detection efforts should focus on identifying anomalous process creation originating from SharePoint worker processes, as well as suspicious network traffic patterns indicative of exploitation attempts.

• Process Monitoring: Monitor for unusual child processes spawned by SharePoint-related processes (e.g., w3wp.exe, owstimer.exe, or other SharePoint service executables). Look for cmd.exe, powershell.exe, pwsh.exe, or other scripting interpreters and uncommon executables.
• Network Traffic Analysis: Look for unusual HTTP/HTTPS requests to SharePoint endpoints that may contain serialized payloads or unexpected data structures. Monitor for outbound connections from SharePoint servers to unknown external IP addresses or domains.
• Application Logs: Review SharePoint ULS logs and IIS logs for errors related to deserialization or unexpected application behavior immediately preceding suspicious process activity.
• Endpoint Telemetry: Hunt for EventID 1 (Process Creation) in Sysmon logs where ParentImage is a SharePoint process and Image is a shell or scripting interpreter.

Sigma Detection Rules

SharePoint Worker Process Spawning Cmd.exe

title: SharePoint Worker Process Spawning Cmd.exe
id: 9a7b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects suspicious execution of cmd.exe by an IIS worker process (w3wp.exe) which commonly hosts SharePoint, indicating potential RCE via CVE-2026-58644.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    ParentImage|endswith: '\\w3wp.exe'
    Image|endswith: '\\cmd.exe'
  condition: selection
level: high

SharePoint Worker Process Spawning PowerShell.exe

title: SharePoint Worker Process Spawning PowerShell.exe
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects suspicious execution of powershell.exe by an IIS worker process (w3wp.exe) which commonly hosts SharePoint, indicating potential RCE via CVE-2026-58644.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    ParentImage|endswith: '\\w3wp.exe'
    Image|endswith: '\\powershell.exe'
  condition: selection
level: high

Mitigations

Prioritize patching and implement compensating controls to reduce the attack surface.

1. Apply Patches: Immediately apply the security update from Microsoft. For SharePoint Server Subscription Edition, update to version 16.0.19725.20434 or later. Apply the latest cumulative updates for SharePoint Server 2016 and 2019 that address CVE-2026-58644.
2. Network Segmentation: Isolate SharePoint servers on a dedicated network segment with strict ingress/egress filtering to limit unauthorized access.
3. Web Application Firewall (WAF): Deploy a WAF in front of SharePoint servers to detect and block malicious requests, particularly those attempting to exploit deserialization vulnerabilities. Configure the WAF to inspect request bodies for suspicious serialized data patterns.
4. Least Privilege: Ensure SharePoint service accounts operate with the minimum necessary privileges.
5. Regular Backups: Maintain regular, tested backups of SharePoint farms to facilitate recovery in the event of a successful compromise.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644
• https://nvd.nist.gov/vuln/detail/CVE-2026-58644

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

• T1190 — Exploit Public-Facing Application
• T1210 — Exploitation of Remote Services
• T1059.003 — Windows Command Shell
• T1059.001 — PowerShell