CVE-2026-58644

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jul 17, 2026

Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Jul 14, 2026
Last modified
Jul 17, 2026
Added to CISA KEV
Jul 16, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-586475.4Improper neutralization of input during web page generation ('cross-site scripting') in Power BI allows an authorized attacker to perform spCVE-2026-586496.5Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.CVE-2026-58658.8Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafCVE-2026-586507.8Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-586517.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2026-586527.5luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate wrCVE-2026-586534.3PraisonAI before 0.1.7 fails to validate that project_id in issue create and update request bodies belongs to the URL workspace. An attackerCVE-2026-586544.3The Grav API plugin (getgrav/grav-plugin-api) 1.0.0 contains an unrestricted file upload vulnerability in the avatar upload endpoint (/api/vCVE-2026-586558.8The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stored server-side template injection vulnerCVE-2026-586567.5Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: *,CVE-2026-586574.8Grav before 2.0.0 (affected through 2.0.0-rc.9 and the 2.0 branch) contains a stored CSS injection vulnerability in the Markdown image resizCVE-2026-586588.2GPUStack through 2.2.1, fixed in commit 4e20551, contains an unauthenticated information disclosure vulnerability that allows unauthenticate
CVE-2026-58644: Critical severity, CVSS 9.8 | Vulnix