Remote arbitrary code execution affecting Microsoft SharePoint Server

Microsoft SharePoint Server is a collaborative platform for document management and business portals, deployed in a professional environment in its locally installed version (on-premises). This product is affected by a vulnerability labeled CVE-2026-58644 resulting from untrusted data deserialization. Exploitation of this vulnerability would allow an unauthenticated attacker to make a specially crafted request to the server to remotely execute arbitrary code with application privileges on the affected system. It is classified critical with a severity score of 9.8 according to CVSS V3.1.

• Microsoft SharePoint Enterprise Server 2016;
• Microsoft SharePoint Server 2019;
• Microsoft SharePoint Server Subscription Edition;

RECOMMENDED ACTIONS:

• Immediately apply security updates released by Microsoft as part of July 2026 Patch Tuesday for affected SharePoint Server products;
• Restrict the exposure of SharePoint servers on the Internet to only strictly necessary access;
• Check affected servers for signs of compromise (unknown files, user accounts, or scheduled tasks);