CVSS v3.1 score of 9.8

www.tenable.com • September 20, 2026

Share: View original

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Published : 2026-07-14

Known Exploited Vulnerability (KEV)

Vector : CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability of Interest

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SharePoint RCE Vulnerabilities Exploited in the Wild CVE-2026-45659 and CVE-2026-58644 are critical remote code execution (RCE) vulnerabilities affecting Microsoft SharePoint Server. CVE-2026-45659, published on May 22, 2026, allows authenticated users to exploit deserialization flaws for RCE under the IIS application pool identity. CVE-2026-58644, discovered in July 2026, enables unauthenticated attackers to execute arbitrary code via a multi-stage exploit chain known as ToolShell. The exploitation of these vulnerabilities has been confirmed in the wild, with CVE-2026-58644 being actively exploited despite a patch released on July 14, 2026. Attackers can leverage stolen machineKey material to forge valid payloads, bypassing authentication checks. Organizations are urged to apply the latest security updates and rotate machineKey values to mitigate risks. The ongoing exploitation of these vulnerabilities highlights a significant shift in targeting enterprise infrastructure. Microsoft SharePoint is increasingly viewed as a primary target for attackers, indicating a need for heightened security measures. 11 sources 73

Extracted Entities

Attack Types (1)

Zero-day Exploit

CWE Weaknesses (1)

CWE-502 - Deserialization Of Untrusted Data

Platforms (1)

Microsoft Office SharePoint