What happened
On July 14, 2026, Microsoft published CVE-2026-58644, a critical deserialization of untrusted data flaw (CWE-502) in on-premises SharePoint Server. The score is CVSS 9.8. An unauthenticated remote attacker can run arbitrary code.
Confirmed exploitation
Microsoft confirmed active exploitation. On July 16, CISA added the CVE to the KEV catalog. Rapid7 and others urged emergency remediation. On July 22, another flaw from the same Patch Tuesday, CVE-2026-50522, also entered KEV: applying all July 14 updates covers both.
Affected products
- SharePoint Enterprise Server 2016
- SharePoint Server 2019
- SharePoint Server Subscription Edition
What to do
Apply the July 14, 2026 updates, verify success on every server, enable AMSI integration on each web application and watch Microsoft Defender detections (for example Exploit:Script/SuspSignoutReqBody.A and ToolPaneAuthBypass). On-premises SharePoint remains a preferred ransomware and initial-access target.