Is CVE-2026-58644 (Microsoft SharePoint Deserialization of Untrusted Data) being exploited in the wild?

Yes. CISA added CVE-2026-58644 to its Known Exploited Vulnerabilities catalogue on 16 July 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.

What “exploited in the wild” means for this SharePoint CVE

For this question, the key distinction is between a vulnerability that exists and a vulnerability that has crossed into active exploitation. CISA’s KEV listing is the practical signal to use here, because it reflects evidence of real-world abuse rather than theoretical risk. For CVE records, that is the point where prioritisation shifts from normal patch planning to urgent exposure handling.

Because the flaw is a deserialization of untrusted data issue in Microsoft SharePoint, the operational concern is not just software correctness. It is the possibility that an attacker can turn malformed input into code execution over the network, which makes any reachable SharePoint instance materially more urgent than a routine bug-fix item.

That is why the right follow-up question is not “Does the CVE exist?” but “Is the asset exposed, and has it been treated as potentially targeted since the date CISA listed it?” For active exploitation questions, the answer should be anchored in authoritative catalogues such as the CISA Known Exploited Vulnerabilities Catalog and the vendor advisory for version and remediation details.

Why deserialization flaws on SharePoint are high-priority

Deserialization bugs are dangerous because they attack a trusted boundary in the application itself. If untrusted input is accepted and interpreted as executable object state, an attacker may be able to reach code execution without needing valid application credentials first. In a platform like SharePoint, that can create exposure for content, configuration, and the broader environment connected to the server.

The material issue is blast radius. A network-reachable execution flaw in collaboration software can become a foothold into internal data stores, service accounts, and adjacent systems, especially when the server has access to shared resources or management interfaces. This is why actively exploited SharePoint flaws tend to be handled as enterprise incidents, not isolated application defects.

For practical triage, pair the vulnerability view with exposure context. If the system is internet-facing, externally reachable through reverse proxy rules, or available through a partner or remote-access path, treat it as higher priority than an internal-only deployment. The NIST National Vulnerability Database is useful for normalising the record, but the exploitability decision should be driven by your own exposure map and CISA’s KEV status.

What to do when patching cannot happen immediately

When a KEV-listed SharePoint flaw cannot be patched right away, the next best control is containment, not delay. Reduce reachable paths to the application, restrict who can access the affected service, and remove unnecessary exposure until the fix is in place. If the product sits behind a gateway, proxy, or load balancer, confirm that no alternate path still exposes the vulnerable endpoint.

You should also assume that an exploited deserialization flaw may have already enabled post-exploitation activity. That means checking for unexpected child processes, newly dropped web content, abnormal admin activity, suspicious outbound connections, and configuration changes that do not fit the server’s normal role. If the server participates in authentication, search for downstream credential exposure as part of the same response.

Where operational constraints force a temporary exception, document the compensating controls and the time limit clearly. For active exploitation cases, an exception without containment is usually just deferred incident response.

Risk and Threat Considerations

This vulnerability is high-risk because it combines active exploitation with code execution over the network. That means attackers do not need to wait for a user mistake or local access, and they may be able to establish a foothold quickly if the service is reachable.

Failure mechanism: The application accepts untrusted serialized data and processes it in a way that can trigger unintended object behavior, allowing remote code execution and follow-on compromise.

Impact: A successful exploit can lead to server takeover, web shell deployment, data access, lateral movement, and potential exposure of credentials or tokens used by the SharePoint host.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST CSF 2.0, OWASP ASVS and SLSA set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.RA-01 — Asset Vulnerabilities Identified and Managed	Active exploitation makes vulnerability identification and exposure assessment central.
	PR.PS-01 — Configuration Management	Containment and hardening are needed when patching is delayed.
	RS.AN-01 — Investigations are Performed	Active exploitation requires checking for compromise indicators and attack traces.
Recommendation — Prioritise the SharePoint instance using current exposure and exploitability evidence. Restrict access paths and remove unnecessary exposure until remediation is complete. Investigate the server for signs of exploitation before returning it to normal trust.
OWASP ASVS	V15 — Secure Coding and Architecture	Deserialization of untrusted data is an application security design failure.
Recommendation — Review the trust boundary and remove unsafe deserialization paths from the application.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	A network-reachable SharePoint deserialization flaw fits public-facing exploitation behaviour.
Recommendation — Hunt for exploitation of the public-facing SharePoint service and related follow-on activity.
OWASP API Security Top 10	API8 — Security Misconfiguration	Exposure and trust-boundary weaknesses around the service can materially worsen exploitation risk.
Recommendation — Check deployment and gateway settings that could widen exposure to the vulnerable service.
SLSA	Supply Chain Integrity	Not directly applicable to the exploit itself, but materially relevant when assessing trusted software input paths and deployment provenance.
Recommendation — Verify the provenance of deployed SharePoint components before accepting them as trusted.

Practitioner Guidance

What to verify: Confirm whether the specific SharePoint instance is internet-reachable, externally proxied, or accessible through any partner path. Then verify whether the server has evidence of post-exploitation activity, not just whether the patch is present.

Decision rule: If the asset is reachable and the flaw is KEV-listed, treat it as an urgent remediation item even before you have perfect certainty about compromise. If patching must wait, narrow access first and preserve forensic evidence before making disruptive changes.

What good looks like: The vulnerable service is either patched or tightly contained, the attack surface is reduced to the minimum required, and your team can explain which systems were checked for signs of compromise and when.

Practitioner takeaway: For KEV-listed SharePoint flaws, the operational standard is rapid exposure reduction plus compromise assessment, not patch-only thinking.