# CVE-2026-58644: Microsoft SharePoint Enterprise Server 2016 - RCE

> Live exploitation tracking for CVE-2026-58644 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-58644

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition
- **Weaknesses:** CWE-502 (Deserialization of Untrusted Data)
- **Tags:** enterprise_software, web_application

## Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

## CrowdSec analysis

[CVE-2026-58644](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-58644) is a critical deserialization vulnerability in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. An unauthenticated attacker can exploit the flaw remotely over a network to execute arbitrary code, potentially compromising sensitive data, modifying content, or disrupting SharePoint services.

CrowdSec has been tracking this vulnerability and its exploits since 27th of August 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-58644 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target the SharePoint WS-Federation passive sign-in endpoint `/_trust/default.aspx`, first probing it for SharePoint-specific headers and then submitting unauthenticated `POST` requests with `wa=wsignin1.0` and a crafted `wresult` parameter. The payload contains a compressed, base64-encoded .NET BinaryFormatter/LosFormatter deserialization chain intended to achieve remote code execution.

## Timeline

- 2026-07-14: CVE Published. CVE-2026-58644 is published to NVD.
- 2026-07-16: CISA KEV. CVE-2026-58644 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-07-19: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2026-08-27: Rule Released. CrowdSec releases a rule to detect CVE-2026-58644 exploitation attempts against the CrowdSec Network.

## References

- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-58644.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-58644) follows observed exploitation activity for CVE-2026-58644. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.