CISA Updates KEV with Critical SharePoint RCE Zero-Day CVE-2026-58644
CISA has added the critical remote code execution (RCE) vulnerability CVE-2026-58644 in Microsoft SharePoint Server to its KEV catalog, requiring federal agencies to apply patches by July 19, 2026. The flaw, rated 9.8/10 on CVSS, is actively exploited in the wild and enables unauthorized code execution through deserialization of untrusted data.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a newly patched security flaw impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by July 19, 2026.
The vulnerability in question is CVE-2026-58644 (CVSS score: 9.8), a critical deserialization
*** END OF TRANSMISSION ***