SharePoint Server flaws exploited as zero-days and within days of patching
July 14, 2026 (July 14 to 22, 2026)
On-premises SharePoint was exploited repeatedly in July. CVE-2026-58644, an unauthenticated deserialization flaw rated 9.8, was used as a zero-day before Microsoft's July 14 fix. A sibling flaw, CVE-2026-50522, also rated 9.8, was exploited soon after public proof-of-concept code appeared around July 20, and CISA listed it on July 22. Attackers were reported stealing server machine keys to keep access. SharePoint Online is not affected.
Why it matters
Researchers count this as at least the third SharePoint exploitation wave this year. Extended support for SharePoint 2019 also ended on July 14, the same day as the fix.
What defenders can take from it
- Patch internet-facing SharePoint within days, not at the next maintenance window.
- After patching, rotate machine keys and service-account credentials and review logs for earlier compromise.
- Plan to retire versions that are out of support.