CISA gave agencies three days to patch a SharePoint flaw

Microsoft published a fix for a critical SharePoint Server flaw on July 14, 2026. Attackers were using it in the wild within a day. Two days after that, CISA added it to the federal Known Exploited Vulnerabilities catalog with a remediation deadline of July 19 — three days, not the two or three weeks agencies were used to.

The vulnerability is CVE-2026-58644, and the compressed timeline around it is the clearest illustration yet of what a directive CISA issued a month earlier actually means in practice.

The flaw

According to the National Vulnerability Database entry, CVE-2026-58644 is a deserialization of untrusted data issue (CWE-502) in Microsoft Office SharePoint that “allows an unauthorized attacker to execute code over a network.” It carries a CVSS v3.1 base score of 9.8, the vector string AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and was published on July 14, 2026.

Affected products are the on-premises SharePoint editions still in support:

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server Subscription Edition

SharePoint Online in Microsoft 365 is not in scope. As with the SharePoint incidents of 2025, the exposure is concentrated in organizations still running the server product themselves, often internet-facing, often behind on cumulative updates.

One point of genuine ambiguity is worth flagging, because it affects how urgently an organization might have triaged the bug on day one. Microsoft’s advisory text describes an attacker “authenticated as at least a Site Owner,” and Tenable’s FAQ lists the flaw as requiring authentication. NVD’s summary and the CVSS vector Microsoft itself assigned — which sets privileges required to none — describe an unauthenticated attacker, and Rapid7 characterized it the same way. Either reading lands in the same place operationally, but the discrepancy is real and appears in the vendor write-ups.

From patch to exploitation in a day

Tenable’s timeline records exploitation of CVE-2026-58644 confirmed on July 15, 2026 — one day after disclosure. Microsoft subsequently revised its bulletin to acknowledge exploitation. CISA added the CVE to its Known Exploited Vulnerabilities catalog on July 16, in an alert covering three vulnerabilities, with a due date of July 19 for federal civilian agencies.

Rapid7 told customers to treat the issue as an emergency: deploy the July 14 updates across every affected SharePoint instance, verify the patch actually landed on each server rather than assuming the deployment tool succeeded, and enable the platform’s Antimalware Scan Interface integration for SharePoint web applications. It also published Microsoft detection signature names that defenders can look for in existing telemetry.

Not the only SharePoint bug this year

CVE-2026-58644 arrived in the middle of a sustained run of SharePoint exploitation. Tenable’s FAQ tracks the cluster of on-premises SharePoint flaws that reached the KEV catalog during 2026:

A fifth flaw disclosed the same day, CVE-2026-55040, a security feature bypass rated 9.1, had not been observed in attacks as of Tenable’s publication. All of them affect all supported on-premises versions, and Tenable lists the specific patched build numbers for each — which matters, because organizations that applied one month’s cumulative update and stopped are not covered for the later ones.

The three-day clock

The reason the July 19 deadline was three days rather than three weeks is Binding Operational Directive 26-04, which CISA issued on June 10, 2026. It replaces uniform severity-based deadlines with a risk-based tiering. A vulnerability that meets all four of the following gets the shortest window: it affects a publicly exposed asset, exploitation can be fully automated, successful exploitation yields control of the system, and there is evidence of active exploitation in the wild.

Nick Andersen, CISA’s acting director, said the directive “provides clear definitions, timelines and criteria that enhances transparency, predictability.” Chris Butera, acting executive assistant director, offered the number that explains the design: in an analysis of one large agency, just 1% of vulnerabilities fell into the three-day tier, while around 60% could safely be deferred to the next upgrade cycle.

The directive was a response to poor compliance under the old model. CISA’s own figures, cited in the CyberScoop report, show only 26% of KEV-listed vulnerabilities were fully remediated in 2025, down from 38%, with a median resolution time of 43 days. Agencies were required to update vulnerability management policies immediately, revise their processes for remediating common vulnerabilities within 60 days, and meet the directive’s remediation timelines in full within 180 days.

What the guidance means outside government

BOD 26-04 binds federal civilian agencies only. But the KEV catalog is free, machine-readable and widely used by private-sector teams as a prioritization feed, and the practical advice being repeated by vendors and CERTs since July is straightforward:

• Treat KEV listing, not CVSS score, as the trigger for emergency change control. CVE-2026-45659 scored 8.8 and CVE-2026-58644 scored 9.8; both were being exploited, which is the fact that matters.
• Inventory internet-facing on-premises SharePoint. Exposure here is almost entirely a legacy-deployment problem.
• Verify patch deployment per server rather than trusting a management console summary — Rapid7 called this out specifically.
• Assume compromise where a server was exposed and unpatched during the exploitation window, and investigate rather than simply patching and moving on.

Verizon’s 2026 Data Breach Investigations Report, published in May, found that 31% of breaches now begin with software vulnerabilities — for the first time overtaking stolen credentials as the leading initial access route. The SharePoint sequence is what that statistic looks like in a single product over a single quarter.

Sources

• CVE-2026-58644 Detail — National Vulnerability Database
• CVE-2026-58644: Microsoft SharePoint Server RCE Exploited in the Wild — Rapid7
• SharePoint Server exploitation FAQ — Tenable
• CISA Adds Three Known Exploited Vulnerabilities to Catalog (July 16, 2026) — CISA
• CISA directive orders agencies to prioritize vulnerability patching in a new way — CyberScoop
• Known Exploited Vulnerabilities Catalog — CISA