The recent addition of a critical SharePoint vulnerability to the CISA's Known Exploited Vulnerabilities (KEV) catalog has sparked concern among federal agencies. This zero-day vulnerability, CVE-2026-58644, with a CVSS score of 9.8, poses a significant threat to Microsoft SharePoint Server users. The flaw allows unauthorized attackers to execute arbitrary code, highlighting the urgent need for patching. Microsoft's advisory emphasizes the ease of exploitation, with low attack complexity due to the attacker's lack of prior knowledge and the payload's success rate. This vulnerability affects SharePoint Server Subscription Edition, 2019, and 2016 versions, making it a widespread concern. The timing is particularly alarming, as CISA had previously warned of active exploitation of multiple SharePoint vulnerabilities, including CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644. These vulnerabilities enable threat actors to gain unauthorized access, steal IIS machine keys, and deploy malware, emphasizing the need for proactive hardening measures. CISA's recommended actions include applying patches, enabling AMSI integration, scanning for intrusion artifacts, and implementing tailored logging mechanisms. Additionally, agencies should restrict SharePoint exposure and follow Microsoft's security-hardening guidance. The addition of Fortinet FortiSandbox vulnerabilities to the KEV catalog further underscores the evolving cybersecurity landscape, requiring agencies to act swiftly to protect their systems from potential threats.
