Hackers Are Already Exploiting a Critical Microsoft SharePoint Flaw Patched Just Days Ago
CISA has added a newly patched SharePoint vulnerability to its active-exploitation watchlist, giving US federal agencies just three days to apply the fix.
Key points
- CVE-2026-58644, a critical flaw in Microsoft SharePoint, scored 9.8 out of 10 and was confirmed as actively exploited after Microsoft's July 2026 Patch Tuesday release.
- Microsoft's July 2026 update also fixed CVE-2026-56164, a separate SharePoint flaw that was already being exploited before the patch existed.
- CISA added CVE-2026-58644 to its Known Exploited Vulnerabilities catalogue on Thursday, ordering federal agencies to patch within three days.
- Two Fortinet FortiSandbox flaws, CVE-2026-25089 and CVE-2026-39808, landed on the same catalogue the same day, both confirmed exploited since mid-June.
A serious flaw in Microsoft SharePoint is being exploited by criminals just days after Microsoft shipped a fix. It won't be the last time we write that sentence: our story on 14 July covered a different wave of active SharePoint attacks.
The new vulnerability, CVE-2026-58644, is a deserialization bug. Deserialization is where software converts stored data back into a usable format; done unsafely, an attacker can slip malicious instructions in with the ordinary data. The result is remote code execution: a criminal runs their own software on your SharePoint server from anywhere on the internet.
There's a precondition: the attacker needs at least "Site Owner" access first. That sounds limiting. It isn't. Credentials get stolen through phishing all the time, and once someone has Site Owner rights the server is theirs.
How bad is this, really?
Bad enough for CISA to add it to its Known Exploited Vulnerabilities catalogue, reserved for flaws confirmed in real attacks. Under Binding Operational Directive 26-04, US federal agencies must patch within three days. That deadline covers government networks only, but it's a reasonable benchmark for any organisation running SharePoint.
Microsoft's advisory didn't initially flag CVE-2026-58644 as exploited. After exploitation was detected, the company updated it and raised the severity score to 9.8.
The July Patch Tuesday bundle covered two other SharePoint flaws worth knowing. CVE-2026-56164 was a zero-day: exploited before any patch existed. CVE-2026-55040, a critical security-bypass bug, could let attackers read private files and alter data.
Should you worry about the Fortinet flaws too?
Yes. CISA also added CVE-2026-25089 and CVE-2026-39808 to the catalogue: both are OS command-injection flaws in Fortinet FortiSandbox, a security appliance that analyses suspicious files. Both let attackers run arbitrary commands on affected devices. Exploit intelligence firm Defused flagged them as exploited in mid-June; Fortinet patched them in April and June respectively. We first reported on these FortiSandbox vulnerabilities on 17 July.
Apply Microsoft's July 2026 Patch Tuesday updates now, prioritising the three SharePoint fixes. Audit Site Owner permissions and remove any that aren't necessary. Check sign-in logs for access outside normal hours or from unfamiliar locations. Remind staff to treat any unexpected email asking for login credentials with suspicion.
The pattern here is the one worth watching: a flaw gets patched, exploitation is detected within days, and federal agencies get a weekend to fix it. The gap between disclosure and attack is shrinking.
