Deserialization of untrusted data in Microsoft Office SharePoint

CVE-2026-58644 is a CWE-502 unsafe deserialization in Microsoft Office SharePoint Server (on-premises). An unauthenticated HTTP POST to a vulnerable handler causes the server to reconstruct an attacker-supplied .NET object graph, yielding RCE as the SharePoint app-pool identity (typically a domain-joined service account with rights across the farm). It is paired with CVE-2026-50522 — the same Pwn2Own Berlin research cluster that spawned the July 2025 ToolShell chain and the May 2026 CVE-2026-45659 refresh. Affected: SharePoint Server 2016, 2019, and Subscription Edition prior to the July 2026 cumulative update; SharePoint Online is not affected.

The CRITICAL / 9.8 vendor label is accurate. Vector AV:N/AC:L/PR:N/UI:N is exactly right for a network-reachable, pre-auth BinaryFormatter-style bug on a product whose entire value proposition is to be reachable by users. Given the same code family already burned tens of thousands of farms in 2025, we treat this as CRITICAL and expect exploitation within days of PoC release, not months.

Why this verdict

• Unauth network RCE, no user interaction — every friction knob in the CVSS vector is at worst-case. There is no authentication gate, no UI gate, no complexity gate to erode the score.
• Role multiplier — SharePoint IS a high-value role: on-prem farms host regulated documents (HR, legal, source, contracts), run under domain-joined service accounts that are routinely over-privileged, and connect to content DBs holding years of business record. Chain ends in domain-adjacent takeover + mass data egress. This is a canonical high-value-role component — floor is CRITICAL.
• Base-rate multiplier — the identical bug class (SharePoint XOML/BinaryFormatter deserialization) has produced ToolShell (2025), CVE-2026-20963 (KEV March 2026), and CVE-2026-45659 (KEV May 2026). Threat actors already have the tooling, dorks, and gadget chains warm.
• Friction audit narrows only slightly: (a) SharePoint Online is unaffected, cutting the customer base but leaving a five-figure internet-exposed on-prem population; (b) AMSI-for-SharePoint blocks *known* gadgets but historically gets bypassed within days; (c) organizations behind AAD App Proxy or ZTNA are shielded. Net adjustment: 9.8 → 9.6.

Why not higher?

9.8 is already the vendor ceiling and the CVSS 3.1 vector is fully maxed. We shave 0.2 only to acknowledge that a meaningful minority of enterprises publish SharePoint via AAD App Proxy / Cloudflare Access / ZTNA, and Microsoft's AMSI for SharePoint raises the bar against off-the-shelf ysoserial gadgets — enough to delay, not defeat, exploitation.

Why not lower?

Downgrading to HIGH would require breaking the CRITICAL floor set by role. That demands installed-base evidence that <10% of affected farms occupy the high-value role — the opposite is true here (essentially 100% of on-prem SharePoint farms are collaboration + content stores). A generic 'requires internet exposure' argument fails because the product's design intent IS to be user-reachable.

1. Apply the July 2026 SharePoint CU immediately — This is the only true fix. Deploy within 3 days per the noisgate CRITICAL mitigation SLA — and treat it as hours-not-days given the ToolShell base rate. Test in a single farm, then push farm-wide with PSConfig.exe / Install-SPService.
2. Rotate ASP.NET machine keys after patching — ToolShell taught the industry that patched farms with stolen keys remain compromised. Run Update-SPMachineKey (or manual web.config rotation + iisreset) on every WFE/App server the same window you patch. Do this within the same 3-day window.
3. Block or authenticate /_layouts/15/ToolPane.aspx and adjacent handlers at the edge — If patching will slip beyond 72 hours, add a WAF / reverse-proxy rule denying anonymous POSTs to layout handlers, or front the farm with AAD App Proxy requiring MFA-gated pre-auth. Deploy the WAF rule within 24 hours.
4. Enable AMSI integration for SharePoint and Defender AV in Full mode — In on-prem SharePoint 2016/2019/SE, verify Set-SPSecurityHardeningPolicy -EnableAntimalwareScan $true and that Defender real-time protection is active on WFEs. Buys hours against commodity gadgets. Do today.
5. Hunt for the ToolShell webshell family and gadget indicators — Search WFEs for new .aspx under %CommonProgramFiles%\Microsoft Shared\Web Server Extensions\1[56]\TEMPLATE\LAYOUTS, especially spinstall*.aspx. Pull IIS logs for POSTs to ToolPane.aspx since 2026-07-14.
6. Isolate the SharePoint farm service account — Migrate to gMSA, remove local admin on non-SharePoint hosts, add to Protected Users, and enforce Tier-1 boundary. This shrinks blast radius the next time this bug class recurs — which it will.

Run on each SharePoint WFE/App server as a local admin (elevated PowerShell). Invoke as .\Check-CVE-2026-58644.ps1. It reads the installed SharePoint build via the SharePoint PSSnapin (or registry fallback) and compares against the July 2026 CU floor. Emits VULNERABLE, PATCHED, or UNKNOWN and sets exit code accordingly.

#Requires -Version 5.1
# Check-CVE-2026-58644.ps1
# Verifies whether a SharePoint on-prem WFE has the July 2026 CU applied.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

$ErrorActionPreference = 'Stop'

# Minimum patched builds per branch (July 2026 CU floor).
# Update these to the exact KB build numbers from MSRC once published.
$fixed = @{
    '16.0.5' = [Version]'16.0.5500.10000'   # Subscription Edition July 2026 CU
    '16.0.10' = [Version]'16.0.10417.20000' # SharePoint 2019 July 2026 CU
    '16.0.4' = [Version]'16.0.4999.10000'   # SharePoint 2016 July 2026 CU
}

function Get-SPBuild {
    try {
        Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction Stop
        return (Get-SPFarm).BuildVersion
    } catch {
        $reg = 'HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\16.0\WSS'
        if (Test-Path $reg) {
            $v = (Get-ItemProperty $reg).Version
            if ($v) { return [Version]$v }
        }
        return $null
    }
}

$build = Get-SPBuild
if (-not $build) {
    Write-Output 'UNKNOWN: SharePoint not detected on this host.'
    exit 2
}

$branchKey = '{0}.{1}.{2}' -f $build.Major, $build.Minor, $build.Build.ToString().Substring(0,1)
$match = $fixed.GetEnumerator() | Where-Object { $build -lt [Version]'16.0.6000' -and $_.Key -like ($build.Major.ToString()+'.'+$build.Minor.ToString()+'*') } | Select-Object -First 1

# Simpler compare: find nearest branch by build ranges
$floor = $null
if ($build.Build -lt 6000)  { $floor = $fixed['16.0.4'] }   # 2016 branch
elseif ($build.Build -lt 11000) { $floor = $fixed['16.0.10'] } # 2019 branch
else { $floor = $fixed['16.0.5'] } # SE branch

Write-Output ("Detected build: {0}" -f $build)
Write-Output ("Required floor: {0}" -f $floor)

if ($build -ge $floor) {
    Write-Output 'PATCHED'
    exit 0
} else {
    Write-Output 'VULNERABLE'
    exit 1
}

Sources

1. ZDI — The July 2026 Security Update Review
2. CISA — SharePoint Hardening Alert (July 2026)
3. Cisco Talos — Microsoft Patch Tuesday July 2026
4. Trellix — ToolShell Unleashed: Decoding the SharePoint Attack Chain
5. FortiGuard Labs — Inside the ToolShell Campaign
6. Akamai — SharePoint RCE: Exploitations, Detections, Mitigations
7. SecurityWeek — CISA Warns of Actively Exploited SharePoint Vuln
8. The Hacker News — SharePoint RCE CVE-2026-45659 Added to KEV