Microsoft SharePoint Remote Code Execution Vulnerability CVE-2026-58644

Historical catalog analysis: CISA added this entry on July 16, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-58644 is a vulnerability in Microsoft SharePoint involving the deserialization of untrusted data (CWE-502). This flaw could allow an unauthorized attacker to execute arbitrary code over a network. Because SharePoint is frequently used by healthcare providers and business associates to store, manage, and collaborate on electronic Protected Health Information (ePHI), a remote code execution (RCE) vulnerability represents a significant risk to the integrity of patient data and the continuity of clinical operations.

Exposure and applicability

This vulnerability applies to organizations utilizing Microsoft SharePoint. The level of risk depends heavily on the deployment architecture; for instance, SharePoint instances that are internet-exposed may face a different threat profile than those restricted to internal networks. Healthcare security leaders should identify all SharePoint installations across their environment, including those managed by business associates, to determine if they are running affected versions.

Remediation priorities

Based on our analysis of the vulnerability’s impact, we suggest the following prioritized actions for healthcare IT and security teams:

1. Apply Vendor Mitigations: The primary priority is to implement the mitigations provided by Microsoft. This addresses the root cause of the deserialization flaw to reduce the likelihood of initial unauthorized access.
2. Responsible Role: System Administrator / SharePoint Owner.

3. Verification: Confirm the application of updates via version checks or vendor-provided update logs.

4. Evaluate Network Exposure: Review whether SharePoint servers are accessible from the public internet. Reducing the attack surface by restricting access to authorized users via VPN or Zero Trust Network Access (ZTNA) could limit the potential for remote exploitation.

5. Responsible Role: Network Security Engineer.

6. Verification: Perform a perimeter scan or review firewall rules to confirm that SharePoint ports are not open to the general internet.

7. Review Access Controls: Ensure the principle of least privilege is applied to SharePoint permissions. While this does not prevent the initial vulnerability, limiting administrative privileges can help reduce the potential damage an attacker could cause if code execution is achieved.

8. Responsible Role: IAM (Identity and Access Management) Specialist.
9. Verification: Audit user permission levels against a documented access matrix.

How to validate remediation

Validation should focus on confirming that the environment no longer meets the conditions required for the vulnerability. This includes verifying that all SharePoint instances have been updated according to vendor instructions. Organizations should coordinate with their clinical engineering and IT teams to ensure that updates are applied during maintenance windows to avoid disrupting patient care services.

Limits and open questions

It is currently unknown whether this vulnerability has been utilized in ransomware campaigns. Furthermore, while applying mitigations reduces risk, it may not completely eliminate all potential attack vectors. Organizations should remain aware that the CISA due date of 2026-07-19 applies specifically to federal agencies and serves as a risk indicator rather than a legal mandate for private healthcare entities. Residual risk remains if third-party business associates managing SharePoint environments on behalf of a provider have not yet applied the necessary updates.

Source and editorial note

CVE-2026-58644: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability · Source date: July 16, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: July 19, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 02, 2026 at 04:06 UTC.

Request a healthcare security assessment