CISA Warns of Microsoft SharePoint Code Execution Vulnerability Exploited in Attacks

CISA has added CVE-2026-58644 — an unsafe deserialization vulnerability in Microsoft SharePoint that allows unauthenticated remote code execution — to its Known Exploited Vulnerabilities catalog after confirming active exploitation; organizations (especially internet-facing SharePoint instances and federal agencies subject to BOD 26-04) are urged to apply Microsoft patches or mitigations, review for indicators of compromise such as web shells and unusual activity, and restrict external access until protections are in place.