CVE-2026-58644: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Microsoft SharePoint contains a deserialization of untrusted data vulnerability tracked as CVE-2026-58644. An unauthorized attacker can exploit it to execute code over a network. This matters because successful exploitation can lead to remote code execution on SharePoint servers, potentially compromising systems that host collaboration and document management services.

How it works

The weakness is classified as CWE-502. An attacker supplies serialized data that the application deserializes without adequate validation or type checking, allowing the attacker to influence object reconstruction and achieve code execution.

Exploitation occurs over the network when the affected SharePoint component processes untrusted input containing the malicious serialized payload. No further details on payload construction or entry points are provided in the available summary.

Am I affected? How to find it in your systems

Microsoft SharePoint is commonly deployed on-premises as part of collaboration infrastructure. Inventory all SharePoint servers and farms through configuration management databases, asset inventories, or direct queries to installed instances.

• Check for SharePoint installations and review their configuration and patch state.
• Confirm whether specific versions or deployment configurations are affected by consulting the vendor advisory directly.
• Review network exposure of SharePoint endpoints, particularly those reachable from untrusted networks.
• Monitor logs for anomalous deserialization-related errors or unexpected process spawns originating from SharePoint worker processes.

How to remediate

Apply the vendor update referenced in the official advisory as the primary remediation step. Follow the exact instructions and sequencing provided by Microsoft.

• After patching, review SharePoint configuration settings related to data handling and serialization to reduce the attack surface for this class of weakness.
• Ensure logging of SharePoint application events is enabled at a level sufficient to detect abnormal behavior.

If you can't patch immediately

Limit network exposure of SharePoint servers through segmentation so that only trusted internal systems can reach management and application endpoints.

• Consider virtual patching or request filtering at network or application boundaries to block suspicious serialized content.
• Disable or restrict features that accept untrusted serialized data if business requirements allow.
• Increase monitoring for indicators of code execution or unusual outbound connections from SharePoint hosts.
• Follow CISA BOD 26-04 guidance on prioritizing updates and evaluating internet exposure; discontinue use of affected instances if mitigations cannot be applied.

If your data may have been exposed

Actively exploited vulnerabilities of this type have led to breaches in other environments. You can run a free exposure scan of your email addresses to check against known breach data.