CVE-2026-58644: Actively Exploited Deserialization Flaw in Microsoft SharePoint
What the Vulnerability Is
CVE-2026-58644 is a deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint. The root cause is unsafe handling of attacker-controlled serialized objects, allowing a crafted payload to be deserialized by the SharePoint application. When successfully exploited, this results in remote code execution (RCE) in the context of the SharePoint application pool worker process.
Affected Software
The vulnerability affects Microsoft SharePoint. No specific affected version range or patch date has been published at this time.
Exploitation Status
This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Defenders should treat this as an urgent, high-priority threat rather than a theoretical risk — attackers are actively weaponizing this flaw against internet-facing SharePoint deployments, and detection and containment should be prioritized accordingly.
How Our Detection Catches It
Exploitation of CVE-2026-58644 typically follows a recognizable pattern: a crafted serialized payload is submitted to a vulnerable SharePoint endpoint (such as ViewState, application pages, or REST/SOAP interfaces), triggering deserialization and code execution within w3wp.exe. Our detection logic focuses on the post-exploitation behaviors that follow, including:
- Abnormal child processes spawned from
w3wp.exe, which is not expected to launch command shells, scripting engines, or LOLBins under normal SharePoint operation - Webshell drops into SharePoint application directories, identified via suspicious file writes to web-accessible paths
- Follow-on credential access activity targeting LSASS, consistent with attacker attempts to harvest credentials after gaining a foothold
This coverage is shipped across our full SIEM matrix — Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Chronicle (YARA-L), and CrowdStrike (CQL) — so teams can deploy consistent detection logic regardless of their existing stack.
Get the Full Detection
For the complete detection logic, including ready-to-deploy queries for each supported SIEM, see the full CVE-2026-58644 detection page.