Microsoft SharePoint Enterprise Server 2016 - RCE (CVE-2026-58644)
Description
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
psychologyCrowdSec Analysis
CVE-2026-58644 is a critical deserialization vulnerability in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. An unauthenticated attacker can exploit the flaw remotely over a network to execute arbitrary code, potentially compromising sensitive data, modifying content, or disrupting SharePoint services.
CrowdSec has been tracking this vulnerability and its exploits since 27th of August 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-58644 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers target the SharePoint WS-Federation passive sign-in endpoint /_trust/default.aspx, first probing it for SharePoint-specific headers and then submitting unauthenticated POST requests with wa=wsignin1.0 and a crafted wresult parameter. The payload contains a compressed, base64-encoded .NET BinaryFormatter/LosFormatter deserialization chain intended to achieve remote code execution.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-07-14 |
| CISA KEV | 2026-07-16 |
| CISA Remediation Deadline | 2026-07-19 |
| Rule Released | 2026-08-27 |