CVE-2026-58644 is a critical-severity deserialization vulnerability in Microsoft SharePoint that permits remote, authenticated attackers with Site Owner level access to inject and execute arbitrary code on the SharePoint server. The flaw was addressed in the July 2026 Microsoft security updates. Initially not marked as exploited, Microsoft later confirmed active exploitation, leading CISA to include it in its KEV catalog and require rapid patching. This vulnerability is part of a set of SharePoint issues patched simultaneously, some of which were also exploited in the wild.

Successful exploitation allows remote attackers authenticated as Site Owners to execute arbitrary code on the SharePoint server, potentially leading to full system compromise or unauthorized actions within the SharePoint environment. This elevates risk for organizations running vulnerable SharePoint versions, especially those with exposed or accessible SharePoint servers.

Microsoft released an official patch for this vulnerability as part of the July 2026 Patch Tuesday updates. Organizations should apply these updates immediately. CISA mandates federal agencies to patch this vulnerability within three days. No alternative mitigations are specified; patching is the primary remediation.