/Vulnerability Library

Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE

CVE-2026-58644
Verified

Description

Microsoft SharePoint Server (2016, 2019, Subscription Edition <= 2026.3.1) contains a remote code execution vulnerability in the WS-Federation passive sign-in endpoint (/_trust/default.aspx). The SharePoint authentication module (SPFederationAuthenticationModuleV2) uses a deflate-only DeflateCookieTransform (no MAC/signature check) to decode and BinaryFormatter to deserialize the SecurityContextToken Cookie value in the wresult parameter without type restrictions. An unauthenticated attacker can send a crafted WS-Federation token containing a BinaryFormatter gadget chain (DataSet + LosFormatter + XamlAssemblyLoadFromFile) to execute arbitrary code in the context of the IIS application pool identity (w3wp.exe). The fix (KB5002882, July 2026 CU) replaces the DeflateCookieTransform with NotSupportedCookieTransform, making ReadToken() throw before deserialization.

Severity

Critical

CVSS Score

9.8

Exploit Probability

16%

Affected Product

sharepoint_server

Published Date

July 21, 2025

Template Author

pdteam

CVE-2026-58644.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-58644
CWE ID:
cwe-502

References

https://nvd.nist.gov/vuln/detail/CVE-2026-58644https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644https://github.com/WismanSec/sharepoint-2026-pochttps://www.rapid7.com/blog/post/etr-cve-2026-58644-microsoft-sharepoint-server-unauthenticated-remote-code-execution-vulnerability-exploited-in-the-wild/https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm

Remediation Steps

Apply the July 2026 Cumulative Update (KB5002882 / build 16.0.19725.20434 or later). After patching, rotate farm machine keys using Set-SPMachineKey or Update-SPMachineKey and perform iisreset to revoke any pre-compromise stolen keys. Enable AMSI request-body scanning for /_trust/default.aspx as defense in depth.