Microsoft SharePoint Server pre-auth BinaryFormatter deserialization remote code execution

#Requires -RunAsAdministrator
<#
  Check-CVE-2026-58644.ps1
  Checks whether the local SharePoint Server is patched against CVE-2026-58644.
  Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
#>

try {
    Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue
    $farm = [Microsoft.SharePoint.Administration.SPFarm]::Local
    if (-not $farm) {
        Write-Host "UNKNOWN - SharePoint farm not detected on this host."
        exit 2
    }
    $buildVersion = $farm.BuildVersion
    $major = $buildVersion.Major
    $minor = $buildVersion.Minor
    $build = $buildVersion.Build
    $rev   = $buildVersion.Revision
    $fullBuild = "$major.$minor.$build.$rev"
    Write-Host "Detected SharePoint build: $fullBuild"

    # Patched build thresholds (July 2026 security updates)
    # Subscription Edition: 16.0.19725.20384
    # Server 2019:          16.0.10417.20153
    # Server 2016:          16.0.5556.1005

    $vulnerable = $false
    $product = "Unknown"

    if ($build -ge 19000) {
        $product = "SharePoint Server Subscription Edition"
        if ([version]$fullBuild -lt [version]"16.0.19725.20384") {
            $vulnerable = $true
        }
    } elseif ($build -ge 10000) {
        $product = "SharePoint Server 2019"
        if ([version]$fullBuild -lt [version]"16.0.10417.20153") {
            $vulnerable = $true
        }
    } elseif ($build -ge 4000) {
        $product = "SharePoint Server 2016"
        if ([version]$fullBuild -lt [version]"16.0.5556.1005") {
            $vulnerable = $true
        }
    } else {
        Write-Host "UNKNOWN - Unrecognized SharePoint build range: $fullBuild"
        exit 2
    }

    Write-Host "Product: $product"

    # Also check AMSI integration status
    $webApps = Get-SPWebApplication -ErrorAction SilentlyContinue
    $amsiDisabled = @()
    foreach ($wa in $webApps) {
        if (-not $wa.AllowAMSIIntegration) {
            $amsiDisabled += $wa.DisplayName
        }
    }

    if ($vulnerable) {
        Write-Host "VULNERABLE - $product build $fullBuild is below the patched threshold for CVE-2026-58644."
        if ($amsiDisabled.Count -gt 0) {
            Write-Host "WARNING - AMSI integration is DISABLED on: $($amsiDisabled -join ', ')"
        }
        exit 1
    } else {
        Write-Host "PATCHED - $product build $fullBuild includes the fix for CVE-2026-58644."
        if ($amsiDisabled.Count -gt 0) {
            Write-Host "NOTE - AMSI integration is DISABLED on: $($amsiDisabled -join ', '). Enable it for defense-in-depth."
        }
        exit 0
    }
} catch {
    Write-Host "UNKNOWN - Error during detection: $($_.Exception.Message)"
    exit 2
}