Loading vulnerability…
CVE-2026-58644 is a critical remote code execution vulnerability in Microsoft Office SharePoint and Microsoft SharePoint Server caused by deserialization of untrusted data. The flaw allows attacker-controlled serialized data to be accepted and reconstructed into object graphs within vulnerable SharePoint processing paths, resulting in server-side code execution. Reporting associated with the issue identifies the bug as related to SharePoint Server and references a WS-Federation BinaryFormatter deserialization path. Microsoft describes the vulnerability as allowing code execution over a network, and multiple reports indicate it affects on-premises SharePoint deployments including SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition prior to the fixed July 2026 security update levels. Public reporting also indicates active exploitation in the wild.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a documented proof-of-concept and detection notes for SharePoint /_trust WS-Federation SecurityContextToken deserialization leading to unauthenticated RCE and machine-key theft. Structure is small and focused: README and index.html provide the writeup; detection/hunting.md contains defender-oriented hunting guidance; artifacts/ contains redacted example telemetry; scripts/ contains the actual exploit code. The main exploit capability is in scripts/cve-2026-58644_oob_param.ps1. It is a parameterized PowerShell exploit that builds a PowerShell payload, base64-encodes it for -EncodedCommand, invokes ysoserial.net to generate a BinaryFormatter gadget (default TypeConfuseDelegate), wraps the raw gadget bytes with System.IdentityModel.DeflateCookieTransform, embeds that into a crafted WS-Federation RequestSecurityTokenResponse, and POSTs it to $Target/_trust/default.aspx with wa=wsignin1.0. Capabilities include arbitrary command execution, optional HTTP callback/beaconing, optional file drop, optional diagnostic exfiltration, proxy support, and optional direct powershell execution via --rawcmd to avoid cmd.exe in the process tree. The second exploit, scripts/cve-2026-58664_machinekeys.ps1, is a two-stage PowerShell exploit for in-process machine-key disclosure. It generates two ysoserial payloads: a preamble using ActivitySurrogateDisableTypeCheck and a main payload using ActivitySurrogateSelectorFromFile to compile embedded C# code (KeyDump) inside w3wp.exe. That C# reflects into System.Web.Configuration.MachineKeySection, extracts ValidationKey/DecryptionKey and related settings, clears the HTTP response, and writes the values back between sentinel markers. This is more stealthy than the OOB RCE path because it avoids child process creation and external beaconing. Overall, this is a real exploit repository rather than a detector-only repo. It is not part of a major exploitation framework. The code is operational but still PoC-style: payloads are customizable through parameters, but execution depends on an external ysoserial.net binary and a vulnerable SharePoint deployment. The most fingerprintable target artifact across both scripts is POST traffic to /_trust/default.aspx carrying wa=wsignin1.0 and a RequestSecurityTokenResponse/SecurityContextToken body.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
149 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote code execution vulnerability in Microsoft SharePoint Server involving WS-Federation and BinaryFormatter deserialization.
Another SharePoint vulnerability mentioned only as background comparison in a list of previously confirmed exploited flaws.
A previously mentioned SharePoint vulnerability cited only as background comparison in a list of other exploited SharePoint flaws this summer.
A Microsoft SharePoint vulnerability listed among vulnerabilities actively exploited or operationally weaponized in July 2026.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.