Microsoft SharePoint Deserialization Remote Code Execution

Technical Analysis

CVE-2026-58644 stems from insecure deserialization of untrusted object data within SharePoint's processing pipeline, allowing an attacker to craft a malicious serialized payload that triggers arbitrary code execution when parsed by the server. Exploitation requires only network access to a vulnerable SharePoint endpoint, with no authentication or user interaction needed, making it wormable in unpatched environments. This class of vulnerability commonly leads to ViewState/gadget-chain style exploitation similar to prior SharePoint deserialization flaws, enabling attackers to drop web shells, escalate privileges, and pivot laterally across the corporate network. Organizations running AI agent frameworks, RAG pipelines, or automation bots that connect to or index content from SharePoint (e.g., Microsoft Graph connectors, Copilot Studio agents, or custom LLM tools pulling documents from SharePoint) risk credential theft, poisoned document ingestion, or full compromise of the host running agent orchestration logic if the underlying SharePoint server is breached.

Affected Systems

Microsoft SharePoint Server (on-premises editions, including SharePoint Server Subscription Edition, SharePoint 2019, and SharePoint 2016); systems exposing SharePoint web front-end services to untrusted networks or the internet

Indicators of Compromise

• No public IOCs disclosed at time of analysis; monitor SharePoint IIS logs for anomalous POST requests to ASPX endpoints with serialized payloads
• Watch for unexpected w3wp.exe child processes (cmd.exe, powershell.exe)
• Unusual .aspx or .ashx web shell file creation in SharePoint hive directories

Remediation Steps

1. 1

   Apply vendor patch

   Immediately apply the Microsoft security update addressing CVE-2026-58644 once released, prioritizing internet-facing SharePoint servers.

2. 2

   Restrict network exposure

   Limit access to SharePoint front-end services to trusted internal networks or VPN, and place a WAF in front of externally exposed instances.

3. 3

   Monitor for exploitation

   Deploy EDR/AV signatures and monitor IIS/w3wp.exe process trees for anomalous child processes indicative of web shell deployment or code execution.

4. 4

   Rotate credentials and service tokens

   Rotate SharePoint service account credentials and any API keys or OAuth tokens used by connected agents, bots, or automation pipelines that authenticate against SharePoint.

5. 5

   Audit agent integrations

   Review any AI agent, RAG, or Copilot integrations that pull data from SharePoint to ensure they operate with least-privilege service accounts and validate ingested content for tampering post-incident.