Patch tracker / CVE reference / CVE-2026-58644
CVE-2026-58644
CVE-2026-58644 is a critical severity Microsoft vulnerability with a CVSS score of 9.8. It is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it in the wild, which makes it a fix-first item. Microsoft has shipped the fix: deploy one of the 3 updates below from the Microsoft Update Catalog, and see where this CVE sits against the rest on the patch tracker.
Risk summary
Listed in the CISA Known Exploited Vulnerabilities catalog, confirmed exploited in the wild. EPSS exploit probability 35%. CVSS 9.8 (Critical).
This CVE is among the lower half of tracked Microsoft CVEs by EPSS exploit probability, and one of 3 actively-exploited CVEs in July 2026.
The strongest signal is CVE-2026-58644's addition to the CISA KEV catalog on 2026-07-16, confirming active exploitation. EPSS then climbed from 0.0% on 2026-07-17 to 35.2% by 2026-07-24, dipped to 27.2% on 2026-07-27, and returned to 35.2% on 2026-07-29. Known exploitation plus an elevated, stable score means you should prioritize remediation today.
Drawn by Senserva Vivid from the Senserva change record. Hover any point for its date and value.
- 2026-07-16 added to the CISA KEV catalog by CISA
- 2026-07-17 EPSS first scored at 0.0%
- 2026-07-23 EPSS 0.0% to 2.0%
- 2026-07-24 EPSS 2.0% to 35.2%
- 2026-07-27 EPSS 35.2% to 27.2%
- 2026-07-29 EPSS 27.2% to 35.2%
Recorded by Senserva on the dates shown, from CISA KEV and FIRST EPSS. This is what moved and when, which neither the vendor advisory nor NVD publishes.
This is a Critical (CVSS 9.8) unauthenticated remote code execution flaw in on-premises SharePoint, affecting Enterprise Server 2016, Server 2019, and Subscription Edition. Despite a low EPSS score of 2 percent, CISA added it to the Known Exploited Vulnerabilities catalog on 2026-07-16, meaning real-world exploitation is confirmed on internet-facing SharePoint farms. Cloud SharePoint Online is not in the affected list, so this is squarely an on-prem server problem.
Do this: Patch all on-premises SharePoint 2016, 2019, and Subscription Edition servers immediately, then rotate machine keys and hunt for web shells since KEV status means exploitation is already occurring.
AI-generated from public data, 2026-07-24. Verify against the vendor advisory before acting.
Senserva AI Opinion and rich prompt for CVE-2026-58644
Copy this prompt into Claude, ChatGPT, or Copilot. The facts are included, sourced from this page.
Official patch(es) for CVE-2026-58644
Treat as urgent: it is being exploited in the wild (CISA KEV), so patch ahead of items that are not. In Intune or Defender, confirm whether the fixing updates KB5002873, KB5002874, KB5002880 are installed across the affected products. Senserva does this automatically across your tenant and flags every missing patch.
Apply the Microsoft security updates below to fix CVE-2026-58644. Each KB page carries the Microsoft Update Catalog download, Microsoft's known issues for the update, a copy-paste PowerShell check for whether it is installed, and the Senserva AI read.
Scope and sources
- Affected products
- Fixed by the same updates
- Authoritative references
Want every Microsoft CVE and the patches that fix it, ranked by real-world risk? See the Microsoft Patch Tracker.