If you run an on-premises SharePoint server or hybrid server, last week's Patch Tuesday isn't one to push off for the “next maintenance window.” CISA has confirmed active in-the-wild exploitation of a critical SharePoint vulnerability, and it's just been added to the Known Exploited Vulnerabilities (KEV) catalog. Here's why this vulnerability matters and why the exploit path is easier than most people assume.
The headline flaw is CVE-2026-58644, rated 9.8 out of 10 on the CVSS scale, about as severe as it gets. It's a deserialization vulnerability, which means the SharePoint server can be tricked into treating attacker-supplied data as trusted, executable code. Microsoft has confirmed it was exploited as a zero-day, meaning attackers were already using it in real attacks before a patch existed.
It doesn't stand alone. CISA has grouped it with three other actively exploited SharePoint flaws (CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164) that together form a chain capable of remote code execution and deeper persistence on the server.
A common assumption is that an attacker needs administrator credentials to do real damage. That's not the case here. Microsoft's advisory notes that an attacker only needs to be authenticated as a Site Owner, a permission level that's far more common than server admin, and one that plenty of ordinary business users hold on one site collection or another, often without anyone realizing the risk it carries.
Once that low bar is cleared, the attack gets easy fast. Microsoft specifically calls out that exploitation requires no deep system knowledge and reliably succeeds every time it's attempted. That combination, a common permission level plus a repeatable, low-skill exploit, is exactly the profile that turns a single compromised account into a server-wide incident.
The real danger is what happens after the initial foothold. This vulnerability chain is being used to steal IIS machine keys directly off the server. Those keys are what SharePoint uses to validate and encrypt internal data and once an attacker has them, they can forge trusted, signed requests to the server indefinitely, without needing to log in again or hold any special credentials at all.
In other words, a single successful exploitation doesn't just give an attacker a foothold, it can hand them a long-term skeleton key to the server and one that a simple password reset won't revoke. That's why CISA isn't just recommending a patch; they are recommending patch, hunt for any evidence of intrusion artifacts, then rotate machine keys, in that order. Rotating keys before checking for compromise risks leaving persistence tools in place.
If you are a RADICL MDR customer, we have already swept your environment for this vulnerability and are actively monitoring for any signs of exploitation.
Zero-days are, by definition, ones you can't prepare for in advance. But how fast you patch is entirely in your control. Given how low the exploitation bar is here, this is one to treat as urgent, not routine.