MicrosoftCVE-2026-58644

Microsoft Office SharePoint: unsafe deserialization

Critical9.8CVE-2026-58644 · Published Jul 14, 2026 · updated Jul 17, 2026

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Microsoft advisory

Affected versions

Package	Affected	Fixed in
Microsoft SharePoint Enterprise Server 2016 Product	>= 16.0.0, < 16.0.5556.1005	16.0.5556.1005
Microsoft SharePoint Server 2019 Product	>= 16.0.0, < 16.0.10417.20153	16.0.10417.20153
Microsoft SharePoint Server Subscription Edition Product	>= 16.0.0, < 16.0.19725.20384	16.0.19725.20384

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-502

More Microsoft advisories

Date	Advisory	Severity	Fixed in
Jul 14	Secret exfiltration vulnerability HighJul 14 CVE-2026-472821.128.1	High	1.128.1
Jul 14	Workspace Trust Security Feature Bypass Vulnerability HighJul 14 CVE-2026-571011.128.1	High	1.128.1
Jul 14	Remote Code Execution Vulnerability HighJul 14 CVE-2026-571021.128.1	High	1.128.1
Jul 14	Microsoft .NET 8.0: unsafe deserialization High7.8Jul 14 CVE-2026-506498.0.29+9 more	High7.8	8.0.29+9 more
Jul 14	Microsoft .NET 8.0: code injection High7.8Jul 14 CVE-2026-506508.0.29+10 more	High7.8	8.0.29+10 more
Jul 14	Microsoft .NET 10.0: resource exhaustion High7.5Jul 14 CVE-2026-5065110.0.10+5 more	High7.5	10.0.10+5 more

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.