CISA adds critical SharePoint zero-day to KEV

Colleagues, I’d like to draw your attention to a cybersecurity update: CISA has added CVE-2026-58644 to the KEV catalog.

This is a critical Microsoft SharePoint Server vulnerability enabling RCE. According to Microsoft, it is already being exploited in the wild as a zero-day.

Affected products include SharePoint Server Subscription Edition, 2019 and 2016. Patches were released on July 14, but the priority now is not only to update — it is also to verify the fixes are actually in place.

CISA also recommends enabling AMSI, hunting for signs of compromise, restricting direct internet access to SharePoint, and securing Central Administration.

Why this matters: vulnerabilities like this move from headline to incident very quickly.

How do you patch and validate SharePoint in cases like this?

#cybersecurity #SharePoint #CISA #ZeroDay