Critical SharePoint bug can let attackers run code remotely
A flaw in Microsoft SharePoint lets attackers send a specially built file to your server, which can then run their own code on it. SharePoint is the web-based tool used for team documents, project sites, and internal wikis.
- Severity
- CriticalCVSS 3.1 ยท 9.8
- Fix
- Fixed in 16.0.19725.20434Fix recorded on Aug 26, 2026
- Affected versions
- 16.0.0 to before 16.0.5556.1005; 16.0.0 to before 16.0.10417.20153; 16.0.0 to before 16.0.19725.20384
- Weakness
- CWE-502Deserialization of Untrusted Data
- Exploit likelihood
- 16% in 30 daysEPSS, higher than 97% of known flaws
- Affects
- Microsoft SharePoint Enterprise Server 2016+2 more
- Exploited
- Yes, in the wildListed by CISA
- Added to CISA list
- Jul 16, 2026
- Federal fix deadline
- Jul 19, 2026
How it works
An attacker sends a malicious file to SharePoint that tricks the server into running code from that file, bypassing SharePoint's normal security checks.
What to do
Check whether the installed sharepoint server version is older than 16.0.19725.20434.
Update sharepoint server to 16.0.19725.20434 or newer. Then verify the installed version.
Technical details
Affected software: Microsoft SharePoint Enterprise Server 2016by Microsoft, Microsoft SharePoint Server 2019by Microsoft, Microsoft SharePoint Server Subscription Editionby Microsoft
CVE-2026-58644 is a deserialization of untrusted data vulnerability (CWE-502) in Microsoft Office SharePoint, rated critical with a CVSS base score of 9.8. Microsoft's advisory states it allows an unauthorized attacker to execute code over a network, meaning no authentication is required to trigger it remotely. No further technical detail on the vulnerable component, endpoint, or a public proof of concept was available in the sources reviewed.
Severity breakdown
- Attack vector Network Requires network access to the vulnerable service
- Attack complexity Low Low complexity under the assessed conditions
- Privileges required None Attacker needs no account or login
- User interaction None No victim action needed
- Scope Unchanged Impact stays within the same security authority
- Confidentiality impact High Sensitive data can be exposed with serious impact
- Integrity impact High Protected data can be changed with serious impact
- Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator