CVE-2026-58644KEV · OVERDUECWE-502

Microsoft SharePoint Remote Code Execution Vulnerability

Critical · published July 14, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 96.9th percentile for exploit probability.

97
days past CISA
deadline
CVSS v3.1
9.8
EPSS
16%
Percentile
96.9
In the wild
Confirmed
What it is

🚨 An attacker can exploit a simple data packet to run arbitrary code across the network! This vulnerability in Microsoft Office SharePoint is like leaving the door wide open for intruders! 🔥 Think of SharePoint as a busy restaurant kitchen. If you let an untrusted delivery driver drop off ingredients without checking them, you might end up with something toxic in your famous dish! That's what happens here – untrusted data sneaks in and executes whatever the attacker wants. The consequences are absolutely devastating. An unauthorized attacker could take complete control of the SharePoint server, access sensitive information, and even manipulate data or disrupt services. With a CVSS score of 9.8, this is a critical flaw that demands immediate attention!

Put simply

Think of SharePoint as a busy restaurant kitchen. If you let an untrusted delivery driver drop off ingredients without checking them, you might end up with something toxic in your famous dish! That's what happens here – untrusted data sneaks in and executes whatever the attacker wants. This vulnerability stems from the deserialization of untrusted data in Microsoft Office SharePoint, allowing attackers to execute arbitrary code over the network. By crafting a malicious data packet, they can bypass security controls and gain unauthorized access.

What to do

The consequences are absolutely devastating. An unauthorized attacker could take complete control of the SharePoint server, access sensitive information, and even manipulate data or disrupt services. With a CVSS score of 9.8, this is a critical flaw that demands immediate attention! Immediately patch your SharePoint installation to the latest version to close this vulnerability. Review your security settings, restrict access to sensitive areas, and train your teams to recognize suspicious activity. Don't wait – every second counts! You've got this! Secure your SharePoint environment and restore peace of mind. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.15873 · 96.9th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-07-14T17:05Z
KEV added
2026-07-16 · due 2026-07-19
EPSS history
Timeline
  • 25 SEP 03:26Z
    EPSS moved 61% → 16%
    epss
  • 23 SEP 03:46Z
    EPSS moved 16% → 61%
    epss
  • 22 SEP 03:42Z
    EPSS moved 16% → 61%
    epss
  • 16 JUL 00:00Z
    Added to CISA KEV — remediate by Jul 19
    kev
  • 14 JUL 17:05Z
    Microsoft SharePoint Remote Code Execution Vulnerability
    cvelistv5