CISA Adds Exploited SharePoint Zero-Day CVE-2026-58644 to KEV

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical remote code execution (RCE) vulnerability affecting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog on Thursday. This newly patched flaw, identified as CVE-2026-58644, carries a critical CVSS score of 9.8, indicating a severe security risk.

As a result of its inclusion in the KEV catalog, federal civilian executive branch (FCEB) agencies are now mandated to implement the necessary security patches for CVE-2026-58644 by July 19, 2026. This directive aims to mitigate the risk of exploitation by malicious actors who are known to be actively targeting this vulnerability.

The vulnerability is described as a deserialization flaw within Microsoft SharePoint Server. Exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code on the affected server, potentially leading to a complete compromise of the system. The urgency of the CISA directive underscores the active exploitation of this zero-day flaw in the wild.