CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV

CISA added a critical SharePoint deserialization vulnerability (CVE-2026-58644, CVSS 9.8) — exploitable remotely and confirmed as exploited in the wild — to its Known Exploited Vulnerabilities catalog, requiring federal agencies to apply Microsoft’s July 14, 2026 patches by July 19, 2026; the advisory highlights risk of RCE, post‑exploitation actions (including IIS machine key theft), and prescribes hardening and patching steps.