Microsoft SharePoint CVE-2026-58644

The specific technical prerequisite is that the attacker must be able to reach a vulnerable SharePoint web endpoint over the network and submit untrusted serialized data that the server deserializes (CWE-502) - the deserialization path is the exploitation surface. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required beyond network reachability: this is remote unauthenticated exploitation against affected on-premises SharePoint Enterprise Server 2016, Server 2019, and Server Subscription Edition installations, requiring no authentication and no user interaction. The primary limiting factors are that only on-premises SharePoint server SKUs are affected (SharePoint Online is not in the CPE list) and that the attacker must have network access to the SharePoint server - internet-exposed farms are at highest risk while purely internal farms require the attacker to first gain internal network position.

All available signals converge on genuine high priority. The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes network-reachable, low-complexity, unauthenticated exploitation with total impact - the worst-case profile for an internet- or intranet-exposed server. EPSS was not provided in the input, so exploitation probability cannot be quantified, and the vulnerability is not in CISA KEV with no public exploit identified at time of analysis, so there is currently no evidence of active exploitation or public POC. However, the combination of unauthenticated .NET deserialization RCE and a widely deployed enterprise product means the theoretical-to-practical gap is small; comparable SharePoint deserialization bugs have been weaponized quickly after disclosure. This is a real patch-now priority rather than a high-CVSS-but-low-real-risk issue, with the caveat that concrete exploitation likelihood (EPSS) and POC status are unknown from the provided data.

An attacker who can reach a SharePoint server over the network sends a crafted HTTP request containing a malicious serialized .NET object to a vulnerable endpoint; when SharePoint deserializes it, an embedded gadget chain executes attacker-chosen commands in the context of the SharePoint application pool. From there the attacker drops a web shell or harvests farm credentials to move laterally. No public POC or exploit code is identified at time of analysis, but the low attack complexity and lack of authentication make reliable exploitation feasible once a working gadget is developed.